| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2014-07-18 01:15:09 | 2014-07-18 01:18:36 | 207 seconds | 1.2-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| machine3 | winxpmacine3 | VirtualBox | 2014-07-18 01:15:10 | 2014-07-18 01:18:36 |
File Details
| File name | aug14audit.pdf | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 127671 bytes | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PDF document, version 1.5 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | 1583DFBC | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | fc05f45f41ee6b62aa9bc0269c5dbc01 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | 7f691d3bc97bb4da7cb6fef4b7527a999c498edb | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | 0c60567d125ce81839a3f6a266f9cf241f46c97d6967f50acb69a35f4b5cab82 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | 3baadc25f9cc083ebd272ed2c15e54c4f096532d3344a9143485f68cc60c2360795857c5540bd3d16e2690e07b52f08ed56fcf681a7c3e6beca279144c36c64b | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | None | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara | None matched | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2014-07-17 01:43:01 Detection Rate: 0/54 (Expand)
|
Signatures
Starts servers listening on 127.0.0.1:0, 0.0.0.0:0
Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate)
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Screenshots
Static Analysis
Dropped Files
Network Analysis
Hosts Involved
| IP Address |
|---|
| 10.129.0.10 |
| 10.129.0.255 |
| 23.0.57.92 |
| 23.62.6.163 |
| 23.62.6.171 |
| 23.37.9.92 |
| 23.62.6.176 |
| 23.62.6.161 |
| 23.62.6.216 |
DNS Requests
| Domain | IP Address |
|---|---|
| service-updates.adobe.com | 23.37.9.92 |
| acroipm2.adobe.com | 23.62.6.218 |
| armmf.adobe.com | 23.37.9.92 |
Behavior Summary
Files
- C:\DOCUME~1
- C:\DOCUME~1\TDW
- C:\DOCUME~1\TDW\LOCALS~1
- C:\DOCUME~1\TDW\LOCALS~1\Temp
- C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf
- C:\Documents and Settings\TDW
- C:\Documents and Settings\TDW\Local Settings\Temp
- C:\WINDOWS\system32\KBDUS.DLL
- C:\WINDOWS
- C:\Program Files\Adobe
- C:\Program Files\Adobe\Reader 11.0\Reader
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx
- C:\Documents and Settings\TDW\Application Data\Adobe
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color
- C:\Documents and Settings\TDW\Application Data\Microsoft\Speech
- C:\WINDOWS\system32
- C:\Documents and Settings\TDW\Local Settings\Application Data\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\
- C:\Documents and Settings\TDW\Local Settings\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\
- C:\WINDOWS\system32\rsaenh.dll
- C:\Documents and Settings\TDW\Application Data\
- C:\Documents and Settings\TDW\Application Data\Adobe\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages
- PIPE\wkssvc
- IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- MountPointManager
- STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
- C:\Documents and Settings
- C:\Documents and Settings\TDW\My Documents
- C:\Documents and Settings\TDW\My Documents\desktop.ini
- C:\Documents and Settings\All Users
- C:\Documents and Settings\All Users\Documents
- C:\Documents and Settings\All Users\Documents\desktop.ini
- C:\Documents and Settings\TDW\Desktop
- C:\Documents and Settings\All Users\Desktop
- C:\WINDOWS\Registration\R000000000007.clb
- C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab
- C:\Documents and Settings\TDW\Application Data\desktop.ini
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\
- C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\P2VGQPEC
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents
- C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal
- C:\Documents and Settings\TDW\Local Settings\Temp\
- PIPE\lsarpc
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R4468.tmp
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files
- C:\Documents and Settings\TDW\Local Settings\History
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\
- C:\
- C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- C:\Documents and Settings\TDW\Cookies\
- C:\Documents and Settings\TDW\Cookies\index.dat
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\
- C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat
- C:\WINDOWS\system32\userenv.dll
- c:\autoexec.bat
- C:\Documents and Settings\TDW\Local Settings
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\*
- C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\*
- C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\WINDOWS\system32\Ras\*.pbk
- C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk
- C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt
- C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets
- C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R4469.tmp
- C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R4469.tmp
- C:\WINDOWS\system32\shell32.dll
Mutexes
- Global\ARM Update Mutex
- Global\Acro Update Mutex
- {100184D2-BDC3-477a-B8D3-65548B67914C}_488
- _!MSFTHISTORY!_
- c:!documents and settings!tdw!local settings!temporary internet files!content.ie5!
- c:!documents and settings!tdw!cookies!
- c:!documents and settings!tdw!local settings!history!history.ie5!
- WininetStartupMutex
- WininetConnectionMutex
- WininetProxyRegistryMutex
Registry Keys
- HKEY_LOCAL_MACHINE\Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\Privileged
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Adobe\Acrobat Reader\11.0
- HKEY_LOCAL_MACHINE\Software\Adobe\Adobe Acrobat\11.0\Security
- HKEY_LOCAL_MACHINE\Software\Adobe\Acrobat Reader\11.0\Installer
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003
- Keyboard Layout\Preload
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D}
- HKEY_CLASSES_ROOT\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions
- HKEY_CLASSES_ROOT\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}
- HKEY_CURRENT_USER\
- HKEY_CLASSES_ROOT\
- HKEY_LOCAL_MACHINE\
- HKEY_USERS\
- HKEY_CURRENT_CONFIG\
- HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\11.0
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0
- HKEY_CURRENT_USER\Software\Adobe\Adobe Synchronizer\11.0
- HKEY_CURRENT_USER\Software\Adobe\CommonFiles\Usage\Reader 11
- HKEY_LOCAL_MACHINE\SOFTWARE\Justsystem\ATOK\Setup\Folder
- HKEY_LOCAL_MACHINE\System
- HKEY_LOCAL_MACHINE\System\Acrobatbrokerserverdispatchercpp789
- Software\Adobe\Acrobat Reader\11.0\Installer\Migrated
- Language
- Software\Adobe\Adobe Synchronizer\11.0
- Software\Adobe\Adobe Synchronizer\11.0\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Offload
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\SOFTWARE\Microsoft\Cryptography\Providers\Type 001
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe
- HKEY_CLASSES_ROOT\.exe
- HKEY_CLASSES_ROOT\exefile
- HKEY_CLASSES_ROOT\exefile\CurVer
- HKEY_CLASSES_ROOT\exefile\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
- HKEY_CLASSES_ROOT\exefile\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\SystemFileAssociations\.exe
- HKEY_CLASSES_ROOT\SystemFileAssociations\application
- HKEY_CLASSES_ROOT\exefile\\Clsid
- HKEY_CLASSES_ROOT\*
- HKEY_CLASSES_ROOT\*\Clsid
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\
- HKEY_CLASSES_ROOT\Directory
- HKEY_CLASSES_ROOT\Directory\CurVer
- HKEY_CLASSES_ROOT\Directory\
- HKEY_CLASSES_ROOT\Directory\\ShellEx\IconHandler
- HKEY_CLASSES_ROOT\Directory\\Clsid
- HKEY_CLASSES_ROOT\Folder
- HKEY_CLASSES_ROOT\Folder\Clsid
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
- HKEY_CLASSES_ROOT\CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Associations
- HKEY_CLASSES_ROOT\.ade
- HKEY_CLASSES_ROOT\.adp
- HKEY_CLASSES_ROOT\.app
- HKEY_CLASSES_ROOT\.asp
- HKEY_CLASSES_ROOT\.bas
- HKEY_CLASSES_ROOT\.bat
- HKEY_CLASSES_ROOT\.cer
- HKEY_CLASSES_ROOT\.chm
- HKEY_CLASSES_ROOT\.cmd
- HKEY_CLASSES_ROOT\.com
- HKEY_CLASSES_ROOT\.cpl
- HKEY_CLASSES_ROOT\.crt
- HKEY_CLASSES_ROOT\.csh
- HKEY_LOCAL_MACHINE\Software\Microsoft\COM3
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes
- HKEY_LOCAL_MACHINE\Software\Classes
- \REGISTRY\USER
- HKEY_LOCAL_MACHINE\Software\Classes\CLSID
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocServerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandler32
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InprocHandlerX86
- \CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\LocalServer
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TreatAs
- HKEY_CLASSES_ROOT\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Ranges\
- HKEY_LOCAL_MACHINE\System\Setup
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\C\
- HKEY_CLASSES_ROOT\PROTOCOLS\Name-Space Handler\*\
- HKEY_CURRENT_USER\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\C
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547
- HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
- HKEY_CLASSES_ROOT\exefile\\shell\open
- HKEY_CLASSES_ROOT\exefile\\shell\open\command
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe
- HKEY_CLASSES_ROOT\exefile\\shell\open\ddeexec
- HKEY_CLASSES_ROOT\Applications\Eula.exe
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache\
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\TreatAs
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocServerX86
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32
- \CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\InprocHandler32
- HKEY_LOCAL_MACHINE\Software\Microsoft\Ole
- HKEY_CLASSES_ROOT\AppID\AcroRd32.exe
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\ComputerName
- ActiveComputerName
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral
- HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles
- Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path2
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path3
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\Path4
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Special Paths
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014071820140719
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AUTOPROXY_CACHE_ANAME_KB921400
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\RETRY_HEADERONLYPOST_ONCONNECTIONRESET
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CHUNK_TIMEOUT_KB914453
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_CERT_TRUST_VERIFIED_KB936882
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BUFFERBREAKING_818408
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_CNAME_FOR_SPN_KB911149
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289
- HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INCLUDE_PORT_IN_SPN_KB908209
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\#16
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1
- HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\OID\EncodingType 1\CertDllOpenStoreProv
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\PhysicalStores
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Volatile Environment
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Certificates
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CRLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\CTLs
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\SystemCertificates\MY\\Keys
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_HTTP_USERNAME_PASSWORD_DISABLE
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing
- HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\RASAPI32
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
- HKEY_USERS\S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections
- HKEY_CURRENT_CONFIG\Software\Microsoft\windows\CurrentVersion\Internet Settings
- HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_URLHOSTNAME
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\Domains\adobe.com
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\\ProtocolDefaults\
- Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2
Processes
registry filesystem process services network synchronization
AcroRd32.exe PID: 488, Parent PID: 268
| Timestamp | Thread | Function | Arguments | Status | Return | Repeated |
|---|---|---|---|---|---|---|
| 09:15:12,524 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:12,524 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsAlloc FunctionAddress => 0x00522e5c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:12,524 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsGetValue FunctionAddress => 0x00522e50 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:12,524 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsSetValue FunctionAddress => 0x00522e44 ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:12,534 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FlsFree FunctionAddress => 0x00522e3c ModuleHandle => 0x7c800000 |
FAILURE | 3221225785 | |
| 09:15:12,534 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:12,794 | 472 | LdrLoadDll |
Flags => 1244460 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,794 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CommandLineToArgvW FunctionAddress => 0x7ca41348 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,794 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,794 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsWow64Process FunctionAddress => 0x7c815229 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x00000080 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegQueryValueExW |
Handle => 0x00000080 DataLength => 4 ValueName => bProtectedMode Type => 1242528 |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | RegCloseKey |
Handle => 0x00000080 |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,804 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sftldr_wow64.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,804 | 472 | FindWindowA |
ClassName => 32770 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateTempDirectory Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,804 | 472 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x0000008c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegQueryValueExW |
Handle => 0x0000008c DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 1244632 |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableAlternateLaunchDesktop Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,804 | 472 | RegCloseKey |
Handle => 0x0000008c |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Adobe\Adobe Acrobat\11.0\Security |
FAILURE | 0x00000002 | |
| 09:15:12,804 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,804 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SetProcessDEPPolicy FunctionAddress => 0x7c862144 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:12,814 | 472 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\ARM Update Mutex |
FAILURE | 3221225524 | |
| 09:15:12,814 | 472 | NtOpenMutant |
Handle => 0x7c80ae80 MutexName => Global\Acro Update Mutex |
FAILURE | 3221225524 | |
| 09:15:12,844 | 472 | FindWindowW |
ClassName => AdobeAcrobatSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:15:12,844 | 472 | FindWindowW |
ClassName => AdobeReaderSpeedLaunchCmdWnd WindowName => |
FAILURE | 0x00000000 | |
| 09:15:12,854 | 472 | LdrLoadDll |
Flags => 1244448 BaseAddress => 0x77690000 FileName => NTMARTA.DLL |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccFreeIndexArray FunctionAddress => 0x77698632 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccTreeResetNamedSecurityInfo FunctionAddress => 0x77699253 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetInheritanceSource FunctionAddress => 0x77698e1d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountTrustee FunctionAddress => 0x776a6901 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetNamedRights FunctionAddress => 0x776925cd ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetNamedRights FunctionAddress => 0x7769324d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetHandleRights FunctionAddress => 0x776930d1 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetHandleRights FunctionAddress => 0x77692f83 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteSetEntriesInAcl FunctionAddress => 0x77692a56 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccRewriteGetExplicitEntriesFromAcl FunctionAddress => 0x77699ec8 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountName FunctionAddress => 0x776a52d2 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccLookupAccountSid FunctionAddress => 0x776a64b3 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccSetEntriesInAList FunctionAddress => 0x776a5c9a ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAccessToSecurityDescriptor FunctionAddress => 0x776a5d8d ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertSDToAccess FunctionAddress => 0x776a5e9c ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetAccessForTrustee FunctionAddress => 0x776a6050 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccConvertAclToAccess FunctionAddress => 0x776a60c9 ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AccGetExplicitEntries FunctionAddress => 0x776a628b ModuleHandle => 0x77690000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | CreateThread |
ThreadId => 0 StartRoutine => 0x0040c2a0 Parameter => 0x0039a858 CreationFlags => 0 |
SUCCESS | 0x000000d0 | |
| 09:15:12,854 | 472 | RegOpenKeyExW |
Handle => 0x000000d4 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | RegQueryValueExW |
Handle => 0x000000d4 DataLength => 4 ValueName => bEnableHeapMitigations Type => 1244592 |
FAILURE | 0x00000002 | |
| 09:15:12,854 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,854 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableHeapMitigations Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,854 | 472 | RegCloseKey |
Handle => 0x000000d4 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapAlloc FunctionAddress => 0x7c9100a4 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HeapFree FunctionAddress => 0x7c90ff0d ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,854 | 472 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:12,854 | 472 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc38c Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:12,854 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | VirtualProtectEx |
Protection => 0x00000080 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | VirtualProtectEx |
Protection => 0x00000002 ProcessHandle => 0xffffffff Address => 0x004fc414 Size => 0x00000004 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | LdrLoadDll |
Flags => 1244440 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\rpcss.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xd6\xffT\x95*?2\xe6\xf9\xc0_u-\xc14<{h,N\x141\xc3\x9b\xb4?i\x8fC\x9a\xda"B\x9a\xaa\x1c\xb6\x08\xc6X\x96\xb7\x11\xafP\x01u=.\x10\x8e\x17\xc9\xfa\xa2\x18\x0cv,\xbf\x1fT\x8e\xf7\x86K\x90!\x19\x14\xc1' \xee\x9d\\xb9\xc5s\xfdD-\x02\x86\xf5\xb2\xf6\x9e,\xa8\xb95X\xec\xb5\xd6D\xe2A\xa9Mz%:\x19\x92\x81\xae\xd7\xbc\xf3\x99\x8d\x10\x07\x16\xdfz\xf7i\x8e\x05\x80].py\xfd\xbeG\x899\xa6h\xaa~\x1a\xcbhS\x8e'\x95\xf6\xa6\x8b\xda\x17\x97\xa4\xf1\x99\x1bB\x9e\xdbT\x92\x91-b\xb0\xb5\xfe\xbd5T\xf9\x89\x7f=\x13Te6\xa2\x00\x02.x\xfcU\xb8\xa0 \xf2\xf4i\xc7\xb9\xea>\x80\x9d\xc9\xf6\xf0\xbb\xefP\x19o\x8d\xddk=t\xba\x99-A \xe6\x9c\x12\x1f\xce<\x98\xd7>\xb8\x907\xe6\x9b\x1f\xd8\xec\xc0\x01\xa6\x80\x89\x98V\x017: \x86\x9b\xd3F.\x02\xd9\xeb\x17\x82PH\x9f\N IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0du\x83\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => ?W>\x0c8\xc2\x9d\xda|Z\xd5$\x10\xfb\x1en\x0e\xf8'm5-\x89\xd9\xf1nU\xa5Y5\xb4G\xfe\xd1\x98)7|\x8f\xfb\xc6io\xac\x16\x9a\x8f'x\x08\xda\x12\xa5t\xf1-\xf3u\x9f\xe2:\xab\x9f j\xea.\xcb\xf5u\x0c\\x88\xb9a\xba\xc1\xffr\xff~\x1b.=\x0f\x0c\xe9\x86\xcd\xd3t 0\xf70\xde\xe4\xc2E\xe6\x89\xe9\x7f\xf1m\x07\xed\xd4\x18\xce\x1d\x18\x19\x0b\xcf\x17\x0c[*C\xb5v\xb1m\x8a\xb4c\x86\xfc\xd4\xcbt\x18\xf2\xc4\xb6\xc7A\xdb&\xaa\xb2x\xea\xc4\x0c\xdakz\xa8*\xf9\xf2\x89d\xae\xfaZ\x877G\xb1\xf7\x89w`\x0b\x14\x97.\x0b\xd8\xd6_\x84w)\xe5\xb5\xa6]\x00\x89]\xf2\xe9B\xc3\x07XJ\x8b\xbe\x895\x84\x8a\xf7\xb4\xbc\x93\x1d2\xc5x\xaa:m\xc9>G7]~\x1c] \xbeM\xc4\xccM\x03\xe9L\x93~\xa9YJ\xf4\xf7\xa1&\x8a\xb8\xf6(U?Qi\xe57[\xc5Xq\xc5#\xe2\xa0\xac\xca"^ IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \xd6\x8b;BS\xff\xb2\x12j\xc8O\xf5&\xa4\xde\x1dS3\xcd\x0bDn\xc29\xf8\xf9\xd7\x00 \xa71u\xa1!\xb7\xbd\xf2\x825\xc2a\x19\xe5ON:\x89\xa3\x9d6\x95\x1d,\xef\xd3\x03\xf6\x00\xafN\xad\x00"\xe3\xb1&\xa6\xd7\x87^ \xb2\x93Mk\xf6 \x1buY\x07\xe2\xbe\x05P\xae\xf9\xe2;\xf7|m\xd3\x99,C\xdf\x8do\xbb!1W\x9f.:y\xf0\x8f\xa2\xf7\x8f\x98\xa1\xe1\x89\x96\xdc0\xeb\x10\x96\x1c\xdcX\xd7v+\xeeE\x1a3\xddL\xb2\xffP\xab\x8f\xf7"{q\x91\xb3ue\xe2\xef\xbc\xac\x9e\x99\xa8\xe75"NV\xee$\xe9\xe5\x04\xbcuM\x15\xce\xfa\xd33\xa7\x86\xad\xd0\x88\x10\x1f.\xa7\x88\x16y\x93B\x94\x16\x9ek\xa3\xecj\xe4\x08\x9f\xeb\x80\x0f\xaf5\xea1x\xc6\xcbh\xa9\x98\x9b#\xe8,(f\xdb @M\xec\xccz\x91B\x18w\xa5\x99b\x0ff8?)\x18\xaf \xc9u\xd8qL\xfe\x8bHl\\x9c0\xba\x01\x9b\x94\xc3\xdb: IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => \x07a\xe2\x19O\xba\xaah\xf8\x99\xd7^<\x9d>\xc54%\xbc\xd8r\xec\x7f\x92\x11/b\xe2#\xfd\xe80\x05\x12r\x87\xbe2WE.4\xbd\x90k\x0ew\xa7\x8bDr\xe6W\xcfV[\xbb\xedv/\xde\xd9\x92_[\x90\x85\xd3\xe3I\x19\x08:\xefmh#+\x9a\x08\xc2\xbf\x14\x9dm\x9eI\xc7F:"\x9f\xe3*4\xff[!\xec\xcd\x00\x99\xe9\xa1\x9a\xdf\xf7,&\xd3 m\xec\x86\x9c\xde\x8a\xf0\xb2\x07\x8fGh\x07\x04C\xbe\x92N\xbb\xfb\xc3By\x19\xe2\xe8\x027c\xddYb\\xdf6\x02b>\x10x\x12\xf3v(\xc3\xa2\x89Jc\xddCae\xbc\x01b\xe8\xc6v\x95]\xf0\x82\xfe\xd8\xf6\xfe\x82\xc1\xd07\x9c \x82\xf9X\xd8\xc6\xb7\x07\xd6m\xee\xb5K9Q\x83!\xa4\x1e\xb4\xe9\xb5d\xb6\x94\xff\x89A\x890u\x96\x10\x8b\x05\xf6\xad}d\x07X\xa1T\xea5\xf4\xc4&\xd3\xf3yqm\xfaL\xee\xdb\xb8D\xbe\x01\x05\x0b\xa6\x1e~\xf1i\xbe\x96#\x9d\x9b IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => |\xddM\xbaLR\x1c\xdb\xd9}\xb57-\x19^aaa\xd0+\xfc\xa9?\xb2\xc1 A\x7f"m\xe8"\x17\xa1\x9b\xa1\xc2\x80~s(1\x86\x16M\x04S\xed\xaf\xf3,\xa3*\xfd"\x1d\xab\x0e}2dz\x82\x9d\x96\xbc=\xabc6N\xf9\xc73\xfa\x1a\xf0\xb1\x10\xa8\x9e\xca;\xb5?\x1c\xeb\x10\xed\x94\xd7\x9b+y\x85\xd4\xdb\xf1\xc7~\x9bB \xfb\xf1\xcd\x9c\x0b\xc59\x8e\x8e8\x92U\xdfZ\xb5Z.Pg}~\x94\xafY\xc0^\x1a/\xa5"\x9b\x85l\xba.+@d\xc8t\xe76\x9d\xb7\xfc\x07\xa1\xb1I\xad\x8f\x8d\xe0\xb5\xbfC\x1c\xc5\x07o\x8e\xc8\xc8\xfa\xad\xe3\x04O\xbd\xdc\x94> \xda\x1e\x92\x95\xe9\xf9\xed\xbd\x9c\xf7E2d\x9d\x942\xd2\xe5\xdc\xc6\x03\xbc\x89\xa7\xac'\xb1\x07ZhR\x06\xcb\x93Z\xc4a\x93R\x86\xee\x88r\x8b\xd4\xea\x9a\xbb\x13i\xac\xfa\x18\xa9\x84&\xf5\x12:_\xe76\xba\x8c\xa3|l\xd4@\x8a'\xe9\xe2^\xe5S7\xea\x90[ IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => e\x87\\xae)\xc2s{ \xd4J\x16\xb4\xb8\xd2\xba$&\xfc\xf1AB\xe7[^r\xe1\xec\x81Q\xce\xff\xdci\xe5\xcf>\x9e\xdc\x13\x06\x96\xfa\x03e\xf1qv+%\x80\xf5K\xe4\x93\x07\xb1\x98a\x91\xcfL\xd7#\xce\xa5\xca\x1bGr\xab\x96MD\xbe\x81tEW\xce\xb0\xbe \x95\x9d\xf95\x8f\xaa\xdc~~\x1ae\xb3\x16\xa5\x88X/L\x19\x05\x05\xa5\x8a\x96\xe0\xb4*\xbd \xf0#0\xc9y\xba\xaba\xb6 \xa9\x05\x8c\x16\x9a\xc9\x19(\xc8<~\xc5\xd9\xe1.\x9a~g\x0eO?C.l\xe9\xbf\x94\xf8\x91\xc9P\x92\xf3f\xa7\x1f \x00\xdf\xf1L@\xaf\x8d\x1c\xacN+\xff\xf9F\x94u\xd2\x06\x19t\xc1\xa1\xb4N\x8d-\xdf\xaa\xed!\x03m[Z\x98\xf0\xd9\x01\xbd\xc2\xc3\x88y\xff\xd07\xa3\xe4l\x83\x89=\xac\xa0\xc0\x9f\xbf\xb3\x80\x86\xcbZ7=\xb1c\x0b\xccL\xa0\\xef{\xd1\xc0i\x9d\x7f1\xc3h'(\x1f\x0e\xf2\x8f\xa9\x80f\x0cn\x93\xd3\xa7!\x15 IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | DeviceIoControl |
DeviceHandle => 0x00000090 OutBuffer => gL\xfc\xa4f\x85P\xe2\x00\x06q\x91\xd4os\xa6\xcbir\xe4kH\xfe_\x18\xear\x89\xfa\x83\x06\x002\xf1\x14\xfc\xb4\xdb\xfb\x10\x01H\x91\xe0d9\xaf\xd4\x0b\x08\xf5i5s\x8f}\xb8\xb1\xb7\xe8m\xd0\x07\\xad\xe5 \xf1\x80)\xea\xbb\xa8__W\xa4 G`SJ\xe6\xc49;1~\xaf\xd6\x96\x90\xfc3\xd3\xfe\x16\xb4\x0e\x07{jJ9\xc6CR "\xbbX,\xd2\xfe\xf3L\x93\xeb\xa86\xbfv;\x14\xa6\xf0 {\xfc\x86\xb6\x18\x08qV\xbdL\xc2\x15\xd7\xd0\xe1\xec\x0c\xce\x1b\x0e\x8cQ\x901\xa5r\zY\x14\x8ay\xd3\x1aC\xdf'\xb27\x0b?TT\xbc\xd2n\xd6\x1c\xc4\x89 \x08z\x8ev%\xefY\xfdeI\xa91\x93\xcd\xf5r\xc6|\xd1\xe3\x1a\x124F\xa4>\xeb\xbc\x93\xacfu\xd1\xb2\x8d\x86\xa9\xbc\xb4 \xbf\xab^\xb1Nq\xf7\x8fM:\x00\x07\x97\x9a\xf9\xf7R\*\xc7\xca\x83\xb9\xc7\xc4\xb4\x1e\xff+ \xeb\xab$\x8e\xbf\xacN\xa6 IoControlCode => 3735560 InBuffer => I\x08\xd2\x0b\x15\xdb\xa3\x85P{\xa2\xb3\xd0d\xb3\x92\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4/\xa8\x98\x86\x84\x1d\xb4\xe9\xb9\xaf9\x9e\xbe\xec_\xf0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | 1 time |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,864 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnforceReadRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,864 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,864 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableGlobalAtomRestrictions Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,864 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,864 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bPreventCreatingExecutables Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,874 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 1244092 |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\Privileged |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 4 ValueName => bEnableBinaryPlantingProtection Type => 4 |
FAILURE | 0x00000006 | |
| 09:15:12,874 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bEnableSameObjectCheck Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x000000d8 DataLength => 4 ValueName => bFilePathPreprocessingShortcutEnabled Type => 1244160 |
FAILURE | 0x00000002 | |
| 09:15:12,874 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | LdrLoadDll |
Flags => 1243912 BaseAddress => 0x77dd0000 FileName => ADVAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SystemFunction036 FunctionAddress => 0x77dd8292 ModuleHandle => 0x77dd0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegOpenKeyExW |
Handle => 0x000000d8 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegQueryValueExW |
Handle => 0x000000d8 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:12,874 | 472 | RegCloseKey |
Handle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001d11a0 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001d11a0 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001d11a0 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001d11a0 | |
| 09:15:12,884 | 472 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x000000d8 |
SUCCESS | 0x00000000 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a0 | |
| 09:15:12,884 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a0 | |
| 09:15:12,884 | 472 | NtOpenDirectoryObject |
DirectoryHandle => 0x000000d8 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:12,894 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x0018a9a0 | |
| 09:15:12,894 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x0018a9a0 | |
| 09:15:12,904 | 472 | LdrLoadDll |
Flags => 1242576 BaseAddress => 0x71b20000 FileName => MPR.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,904 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WNetGetUniversalNameW FunctionAddress => 0x71b2c7a6 ModuleHandle => 0x71b20000 |
SUCCESS | 0x00000000 | |
| 09:15:12,904 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
FAILURE | 0x00000002 | |
| 09:15:12,904 | 472 | CreateThread |
ThreadId => 264 StartRoutine => 0x00420110 Parameter => 0x00d54060 CreationFlags => 0 |
SUCCESS | 0x000000f0 | |
| 09:15:12,904 | 472 | CreateThread |
ThreadId => 556 StartRoutine => 0x00420670 Parameter => 0x00d548c0 CreationFlags => 0 |
SUCCESS | 0x000000fc | |
| 09:15:12,904 | 472 | RegOpenKeyExW |
Handle => 0x00000100 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:12,904 | 472 | RegQueryValueExW |
Handle => 0x00000100 DataLength => 4 ValueName => bDisableCryptBroker Type => 1243612 |
FAILURE | 0x00000002 | |
| 09:15:12,904 | 472 | RegCloseKey |
Handle => 0x00000100 |
SUCCESS | 0x00000000 | |
| 09:15:12,904 | 472 | CreateThread |
ThreadId => 580 StartRoutine => 0x00421670 Parameter => 0x00d9dc60 CreationFlags => 0 |
SUCCESS | 0x00000108 | |
| 09:15:12,904 | 472 | CreateThread |
ThreadId => 584 StartRoutine => 0x004217e0 Parameter => 0x00d540d0 CreationFlags => 0 |
SUCCESS | 0x00000114 | |
| 09:15:12,904 | 584 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitialize FunctionAddress => 0x77502a53 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | CreateThread |
ThreadId => 576 StartRoutine => 0x004219b0 Parameter => 0x00d54980 CreationFlags => 0 |
SUCCESS | 0x00000120 | |
| 09:15:12,924 | 472 | CreateThread |
ThreadId => 588 StartRoutine => 0x00421e70 Parameter => 0x0039a8c0 CreationFlags => 0 |
SUCCESS | 0x0000013c | |
| 09:15:12,924 | 472 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000140 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | NtOpenKey |
DesiredAccess => 983103 KeyHandle => 0x00000144 ObjectAttributes => Keyboard Layout\Preload |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | NtQueryValueKey |
Information => 0\x000\x000\x000\x000\x004\x000\x009\x00\x00\x00 KeyHandle => 0x00000144 ValueName => 1 Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000140 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\Keyboard Layouts\00000409 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | NtQueryValueKey |
Information => K\x00B\x00D\x00U\x00S\x00.\x00D\x00L\x00L\x00\x00\x00 KeyHandle => 0x00000140 ValueName => Layout File Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | NtQueryValueKey |
KeyHandle => 0x00000140 ValueName => Attributes |
FAILURE | 3221225524 | |
| 09:15:12,924 | 472 | LdrLoadDll |
Flags => 1240992 BaseAddress => 0x5fff0000 FileName => KBDUS.DLL |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x00000003 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:12,924 | 472 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x00000005 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:12,924 | 472 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x00000006 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:12,924 | 472 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x5fff1a5a ModuleHandle => 0x5fff0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,924 | 472 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x00000002 ModuleHandle => 0x5fff0000 |
FAILURE | 3221225784 | |
| 09:15:12,934 | 584 | LdrLoadDll |
Flags => 21362876 BaseAddress => 0x5ad70000 FileName => C:\WINDOWS\system32\uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,934 | 584 | IsDebuggerPresent | FAILURE | 0x00000000 | ||
| 09:15:12,934 | 584 | LdrLoadDll |
Flags => 21362696 BaseAddress => 0x5ad70000 FileName => uxtheme.dll |
SUCCESS | 0x00000000 | |
| 09:15:12,934 | 472 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\KBDUS.DLL DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x0000014c |
SUCCESS | 0x00000000 | |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => adialhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => acpiz.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => avgrsstx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylonchromepi.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => babylo~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => btkeyind.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmcsyshk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cmsetac.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => cooliris.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dockshellhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => docksh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => easyho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => googledesktopnetwork3.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => google~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => fwhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprocesscreation.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookterminateapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookte~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookprintapis.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => hookpr~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => imon.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ioloHL.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => kloehk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenforcer.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lawenf~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => libdivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprcinj01.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => lvprci~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => madchook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mdnsnsp.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => moonsysh.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => mpk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npdivx32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.des |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => npggNT.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => oawatch.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10513.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10514.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10515.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10516.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10517.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10518.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,934 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10519.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10520.dll |
FAILURE | 3221225781 | |
| 09:15:12,945 | 584 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10520.dll |
FAILURE | 3221225781 | |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10521.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10522.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,945 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexplorer-10523.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => owexpl~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsphook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavlsp~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavshookwow.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pavsho~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctavh~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => pctgmhk.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => prntrack.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protector.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => protec~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radhslib.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,955 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => radprlib.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rapportnikko.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rappor~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rlhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rooksdol.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchromebrowserrecordhelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rpchro~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => r3hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sahook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sbrige.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sc2hook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sdhook32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => sguard.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smum32.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => smumhook.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => ssldivx.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => syncor11.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => systools.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => tfwah.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wblind.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => wbhelp.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winstylerthemehelper.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => winsty~1.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:12,965 | 472 | RegOpenKeyExW |
Handle => 0x00000154 Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:12,965 | 472 | RegQueryValueExW |
Handle => 0x00000154 DataLength => 4 ValueName => bUseWhitelistConfigFile Type => 1243632 |
FAILURE | 0x00000002 | |
| 09:15:12,965 | 472 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:15:12,965 | 472 | RegOpenKeyExW |
Handle => 0x00000154 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:12,965 | 472 | RegQueryValueExW |
Handle => 0x00000154 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:12,965 | 472 | RegCloseKey |
Handle => 0x00000154 |
SUCCESS | 0x00000000 | |
| 09:15:12,965 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | RegOpenKeyExW |
Handle => 0x00000158 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | RegQueryValueExW |
Handle => 0x00000158 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | RegCloseKey |
Handle => 0x00000158 |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 584 | ZwMapViewOfSection |
SectionOffset => 0x0145f6f0 SectionHandle => 0x00000158 ProcessHandle => 0xffffffff BaseAddress => 0x01770000 |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x001e71a0 | 1 time |
| 09:15:12,975 | 472 | RegOpenKeyExW |
Handle => 0x00000160 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | RegQueryValueExW |
Handle => 0x00000160 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | RegCloseKey |
Handle => 0x00000160 |
SUCCESS | 0x00000000 | |
| 09:15:12,975 | 472 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001e71a0 | 2 times |
| 09:15:12,985 | 472 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001e71a0 | |
| 09:15:12,985 | 472 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x001e71a0 | |
| 09:15:12,985 | 472 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x001e71a0 | |
| 09:15:12,985 | 472 | RegCreateKeyExW |
Handle => 0x00000160 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | RegQueryValueExW |
Handle => 0x00000160 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | RegCloseKey |
Handle => 0x00000160 |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | RegCreateKeyExW |
Handle => 0x00000160 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | RegSetValueExW |
Handle => 0x00000160 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | RegCloseKey |
Handle => 0x00000160 |
SUCCESS | 0x00000000 | |
| 09:15:12,985 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | 3 times |
| 09:15:12,995 | 584 | GetSystemMetrics |
SystemMetricIndex => 31 |
SUCCESS | 0x00000019 | 1 time |
| 09:15:12,995 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | 1 time |
| 09:15:12,995 | 472 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | RegQueryValueExW |
Handle => 0x0000015c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | RegSetValueExW |
Handle => 0x0000015c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Local AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:15:12,995 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | 3 times |
| 09:15:13,005 | 472 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | RegQueryValueExW |
Handle => 0x0000015c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | RegCreateKeyExW |
Handle => 0x0000015c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | RegSetValueExW |
Handle => 0x0000015c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00o\x00r\x00a\x00r\x00y\x00 \x00I\x00n\x00t\x00e\x00r\x00n\x00e\x00t\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => Cache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | RegCloseKey |
Handle => 0x0000015c |
SUCCESS | 0x00000000 | |
| 09:15:13,005 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | 7 times |
| 09:15:13,015 | 472 | CreateDirectoryExW |
DirectoryName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx |
SUCCESS | 0x00000001 | |
| 09:15:13,015 | 472 | NtCreateFile |
ShareAccess => 3 FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000160 |
SUCCESS | 0x00000000 | |
| 09:15:13,015 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x001e79a0 | |
| 09:15:13,015 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,015 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x001e79a0 | |
| 09:15:13,015 | 472 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x001e79a0 | |
| 09:15:13,015 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHCreateDirectoryExW FunctionAddress => 0x7ca0b24a ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,015 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:15:13,015 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:13,025 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:13,025 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:15:13,025 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoNetHood Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoPropertiesMyComputer Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoInternetIcon Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:13,025 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,025 | 472 | LdrGetProcedureAddress |
Ordinal => 236 FunctionName => FunctionAddress => 0x773e1798 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | LdrLoadDll |
Flags => 1239076 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMalloc FunctionAddress => 0x774fdd08 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoCommonGroups Type => 1239916 |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateBindCtx FunctionAddress => 0x774fe54c ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Objects\{20D04FE0-3AEA-1069-A2D8-08002B30309D} |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoControlPanel Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegOpenKeyExW |
Handle => 0x00000164 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegQueryValueExW |
Handle => 0x00000164 DataLength => 4 ValueName => NoSetFolders Type => 1238272 |
FAILURE | 0x00000002 | |
| 09:15:13,035 | 472 | RegCloseKey |
Handle => 0x00000164 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegOpenKeyExA |
Handle => 0x0000016a Registry => 0x80000000 SubKey => CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:13,035 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00S\x00H\x00E\x00L\x00L\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | LdrLoadDll |
Flags => 1238852 BaseAddress => 0x7c9c0000 FileName => C:\WINDOWS\system32\SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,045 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:13,045 | 472 | RegOpenKeyExW |
Handle => 0x00000168 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | RegQueryValueExW |
Handle => 0x00000168 DataLength => 4 ValueName => AllowFileCLSIDJunctions Type => 1237108 |
FAILURE | 0x00000002 | |
| 09:15:13,045 | 472 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,045 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,055 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,055 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:15:13,055 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,055 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,055 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,055 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,065 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,065 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:15:13,065 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,075 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,075 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,085 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,085 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,085 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x001e79a0 | |
| 09:15:13,085 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001e79a0 | |
| 09:15:13,085 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
FAILURE | 0x00000000 | |
| 09:15:13,085 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:13,085 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:13,095 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings |
FAILURE | 0x00000000 | |
| 09:15:13,095 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data |
FAILURE | 0x00000000 | |
| 09:15:13,095 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00000001 | |
| 09:15:13,095 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,095 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,095 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00000001 | |
| 09:15:13,105 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,105 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,105 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00000001 | |
| 09:15:13,115 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,115 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,115 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,125 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,125 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x001e79a0 | |
| 09:15:13,125 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x001e79a0 | |
| 09:15:13,125 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x00000001 | |
| 09:15:13,125 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,125 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,125 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,135 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,135 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x001e79a0 | |
| 09:15:13,135 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Linguistics |
SUCCESS | 0x00000001 | |
| 09:15:13,135 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,135 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,135 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,145 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,145 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x00000001 | |
| 09:15:13,145 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,145 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,145 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,145 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Speech |
SUCCESS | 0x001e79a0 | |
| 09:15:13,155 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\LogTransport2 |
SUCCESS | 0x00000001 | |
| 09:15:13,155 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,155 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,155 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,165 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,165 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,165 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,175 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Headlights |
SUCCESS | 0x00000001 | |
| 09:15:13,175 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,175 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,175 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,175 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
FAILURE | 0x00000000 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings |
FAILURE | 0x00000000 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW |
FAILURE | 0x00000000 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data |
FAILURE | 0x00000000 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe |
FAILURE | 0x00000000 | |
| 09:15:13,185 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player |
SUCCESS | 0x00000001 | |
| 09:15:13,185 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | RegQueryValueExW |
Handle => 0x0000016a Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | RegEnumKeyW |
Handle => 0x0000016e Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,185 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000016c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,185 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | CreateDirectoryW |
DirectoryName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache |
SUCCESS | 0x00000001 | |
| 09:15:13,195 | 472 | RegOpenKeyExW |
Handle => 0x0000016a Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | RegOpenKeyExW |
Handle => 0x0000016e Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | RegQueryValueExW |
Handle => 0x0000016e Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | RegCloseKey |
Handle => 0x0000016e |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | RegEnumKeyW |
Handle => 0x0000016a Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:13,195 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x00000168 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef60 SectionHandle => 0x00000168 ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,195 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012ef80 SectionHandle => 0x0000016c ProcessHandle => 0xffffffff BaseAddress => 0x003b0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,205 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x001e79a0 | |
| 09:15:13,205 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | 3 times |
| 09:15:13,205 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | RegQueryValueExW |
Handle => 0x0000016c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | RegSetValueExW |
Handle => 0x0000016c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00M\x00y\x00 \x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Personal Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,205 | 472 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x001e79a0 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtQueryObject FunctionAddress => 0x7c90d870 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x0000016a Access => 33554432 Registry => 0x80000000 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x0000016a |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,215 | 472 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000168 Access => 33554432 Registry => 0x80000002 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000168 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x0000016c Access => 33554432 Registry => 0x80000003 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x0000016c |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000170 Access => 33554432 Registry => 0x80000005 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000174 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Acrobat\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000170 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000170 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000170 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000170 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x0000017c Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:13,225 | 472 | RegCreateKeyExW |
Handle => 0x00000178 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000178 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000178 Access => 983103 Registry => 0x80000001 Class => SubKey => Software\Adobe\CommonFiles\Usage\Reader 11 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,235 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,245 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,245 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,245 | 472 | RegCreateKeyExW |
Handle => 0x00000180 Access => 33554432 Registry => 0x80000001 Class => SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:13,245 | 472 | RegCloseKey |
Handle => 0x00000180 |
SUCCESS | 0x00000000 | |
| 09:15:13,245 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:15:13,245 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok23 Type => 1 |
FAILURE | 0x00000006 | |
| 09:15:13,245 | 472 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Justsystem\ATOK\Setup\Folder |
FAILURE | 0x00000002 | |
| 09:15:13,245 | 472 | RegQueryValueExW |
Handle => 0x00000000 DataLength => 0 ValueName => Atok24 Type => 1 |
FAILURE | 0x00000006 | |
| 09:15:13,245 | 472 | NtCreateMutant |
Handle => 0x00000180 InitialOwner => 0 MutexName => {100184D2-BDC3-477a-B8D3-65548B67914C}_488 |
SUCCESS | 0x00000000 | |
| 09:15:13,255 | 472 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeChangeNotifyPrivilege |
SUCCESS | 0x00000001 | 19 times |
| 09:15:13,335 | 472 | FindWindowW |
ClassName => 0 WindowName => _AcroAppTimer |
FAILURE | 0x00000000 | |
| 09:15:13,335 | 472 | FindWindowW |
ClassName => 0 WindowName => SafeNet Borderless Single Sign On..... |
FAILURE | 0x00000000 | |
| 09:15:13,335 | 472 | LdrLoadDll |
Flags => 1241956 BaseAddress => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,335 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CreateProcessInternalWSecure FunctionAddress => 0x7c8806f8 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,355 | 472 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe ProcessId => 1468 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe" --channel=488.0.633609382 --type=renderer "C:\DOCUME~1\TDW\LOCALS~1\Temp\aug14audit.pdf" ThreadHandle => 0x000001ac ProcessHandle => 0x000001a8 ThreadId => 1384 CreationFlags => 0x0100040c |
SUCCESS | 0x00000001 | |
| 09:15:13,355 | 472 | NtGetContextThread |
ThreadHandle => 0x000001ac |
SUCCESS | 0x00000000 | |
| 09:15:13,365 | 472 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053e3c0 |
SUCCESS | 0x00000001 | |
| 09:15:13,365 | 472 | WriteProcessMemory |
Buffer => \x08\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053e3c4 |
SUCCESS | 0x00000001 | |
| 09:15:13,365 | 472 | WriteProcessMemory |
Buffer => h\x05\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053f428 |
SUCCESS | 0x00000001 | |
| 09:15:13,365 | 472 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053e3b3 |
SUCCESS | 0x00000001 | |
| 09:15:13,365 | 472 | WriteProcessMemory |
Buffer => \x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053e3b2 |
SUCCESS | 0x00000001 | |
| 09:15:13,365 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,365 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtOpenKeyEx FunctionAddress => 0x00502a70 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:15:13,365 | 472 | RegOpenKeyExW |
Handle => 0x0000019c Registry => 0x80000002 SubKey => Software\Policies\Adobe\Acrobat Reader\11.0\FeatureLockDown |
SUCCESS | 0x00000000 | |
| 09:15:13,375 | 472 | RegQueryValueExW |
Handle => 0x0000019c DataLength => 4 ValueName => bDisableCryptBroker Type => 1242944 |
FAILURE | 0x00000002 | |
| 09:15:13,375 | 472 | RegCloseKey |
Handle => 0x0000019c |
SUCCESS | 0x00000000 | |
| 09:15:13,375 | 472 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => dgapi.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:13,375 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,375 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtAddAtomEx FunctionAddress => 0x0051c138 ModuleHandle => 0x7c900000 |
FAILURE | 3221225785 | |
| 09:15:13,375 | 472 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00\x00\x00\x00\x00\xa8\x00\x00\x00(\x00\x00\x00\x04\x00\x00\x00\x00\x00k\x00e\x00r\x00n\x00e\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x0f\x00\x00\x00\xd0FF\x00CreateProcessW\x00\x00 \x00\x00\x00\x03\x00\x00\x00\x10\x00\x00\x00PHF\x00CreateProcessA\x00\x00 \x00\x00\x00\x02\x00\x00\x00^\x00\x00\x000vN\x00MoveFileExW\x00\x00\x00\x00\x00 \x00\x00\x00\x03\x00\x00\x00!\x01\x00\x00@\x9aA\x00CreateThread\x00\x00\x00\x00T\x04\x00\x00(\x00\x00\x00\x1a\x00\x00\x00\x00\x00C\x00r\x00y\x00p\x00t\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00\x00\x00$\x00\x00\x00\x02\x00\x00\x00)\x00\x00\x00P\x9fN\x00CryptProtectData\x00\x00\x00\x00(\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x00bd0000 |
SUCCESS | 0x00000001 | |
| 09:15:13,375 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,375 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,375 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,385 | 472 | ReadProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,385 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,385 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,385 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,385 | 472 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2,\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x80\xbe\x00\xc7D$\x04\x10+A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8010 |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | WriteProcessMemory |
Buffer => \xb8%\x00\x00\x00\xba(\x80\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d090 |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d090 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | ReadProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:15:13,385 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x18\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x80\xbe\x00\xc7D$\x04P\x10@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8050 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8t\x00\x00\x00\xbah\x80\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d580 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d580 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x80\xbe\x00\xc7D$\x04\xe0G@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8090 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\x8b\x00\x00\x00\xba\xa8\x80\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d6f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d6f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x80\xbe\x00\xc7D$\x04\x00\xedA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be80d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\x95\x00\x00\x00\xba\xe8\x80\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d790 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d790 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x81\xbe\x00\xc7D$\x04 \xbdA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8110 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8\xe0\x00\x00\x00\xba(\x81\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90dc40 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90dc40 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x81\xbe\x00\xc7D$\x04pL@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8150 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8#\x00\x00\x00\xbah\x81\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d070 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d070 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x81\xbe\x00\xc7D$\x04\xd0KA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8190 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8r\x00\x00\x00\xba\xa8\x81\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d560 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d560 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,395 | 472 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x81\xbe\x00\xc7D$\x04`\x9dA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be81d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,395 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8)\x00\x00\x00\xba\xe8\x81\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d0d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d0d0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x82\xbe\x00\xc7D$\x04\x00\x10@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8210 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8w\x00\x00\x00\xba(\x82\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5b0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d5b0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x82\xbe\x00\xc7D$\x04\x00NA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8250 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8x\x00\x00\x00\xbah\x82\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5c0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d5c0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x82\xbe\x00\xc7D$\x04@K@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8290 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8+\x00\x00\x00\xba\xa8\x82\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d0f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d0f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x1c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x82\xbe\x00\xc7D$\x04\xa0@@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be82d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb82\x00\x00\x00\xba\xe8\x82\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d160 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d160 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x83\xbe\x00\xc7D$\x04P\x13@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8310 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8}\x00\x00\x00\xba(\x83\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d610 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d610 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x83\xbe\x00\xc7D$\x04\x10\x8dF\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8350 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8A\x00\x00\x00\xbah\x83\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d250 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d250 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x83\xbe\x00\xc7D$\x04`EF\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8390 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8\x80\x00\x00\x00\xba\xa8\x83\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d640 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d640 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x83\xbe\x00\xc7D$\x040\xb1A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be83d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8z\x00\x00\x00\xba\xe8\x83\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5e0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d5e0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x84\xbe\x00\xc7D$\x040B@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8410 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8{\x00\x00\x00\xba(\x84\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d5f0 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d5f0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x84\xbe\x00\xc7D$\x04PJA\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8450 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | WriteProcessMemory |
Buffer => \xb8\xe5\x00\x00\x00\xbah\x84\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90dc90 |
SUCCESS | 0x00000001 | |
| 09:15:13,405 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90dc90 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x84\xbe\x00\xc7D$\x04\xd05A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8490 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x81\x00\x00\x00\xba\xa8\x84\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d650 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d650 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x10\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x84\xbe\x00\xc7D$\x04\x00\x99A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be84d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8|\x00\x00\x00\xba\xe8\x84\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d600 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d600 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x85\xbe\x00\xc7D$\x04\xf0C@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8510 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x82\x00\x00\x00\xba(\x85\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d660 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d660 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x85\xbe\x00\xc7D$\x04\x80#A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8550 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x08\x00\x00\x00\xbah\x85\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90cec0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90cec0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x0c\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x85\xbe\x00\xc7D$\x04\xa0\xf4A\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8590 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8L\x00\x00\x00\xba\xa8\x85\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d300 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x04\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\xd0\x85\xbe\x00\xc7D$\x04\x80\x7fN\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be85d0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8<\x00\x00\x00\xba\xe8\x85\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d200 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d200 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x14\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x10\x86\xbe\x00\xc7D$\x04p\x80N\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8610 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8\x96\x00\x00\x00\xba(\x86\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d7a0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d7a0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2(\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0cP\x86\xbe\x00\xc7D$\x04\x80\x14@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8650 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | WriteProcessMemory |
Buffer => \xb8l\x00\x00\x00\xbah\x86\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90d500 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90d500 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | ReadProcessMemory |
Buffer => \xf0\xe4\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x7ffe0300 |
SUCCESS | 0x00000001 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,415 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\x00\x03\xfe\x7f\xff\x12\xc2\x08\x00\x90\x00\x00\x00\x00\x00\x00\x00\x00\x83\xec\x08R\x8bT$\x0c\x89T$\x08\xc7D$\x0c\x90\x86\xbe\x00\xc7D$\x04pI@\x00Z\xc3 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8690 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | VirtualProtectEx |
Protection => 0x00000008 ProcessHandle => 0x000001a8 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \xb8\x0b\x01\x00\x00\xba\xa8\x86\xbe\x00\xff\xe2 ProcessHandle => 0x000001a8 BaseAddress => 0x7c90def0 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x7c90def0 Size => 0x0000000c |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \x10\x07\x00\x00\xd0\x06\x00\x00\x8c\xf7\x12\x00\x1b\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x00be8000 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | VirtualProtectEx |
Protection => 0x00000020 ProcessHandle => 0x000001a8 Address => 0x00be8000 Size => 0x00000710 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => P\x86\xbe\x00\x90\x86\xbe\x00P\x84\xbe\x00\x90\x84\xbe\x00\x10\x85\xbe\x00\x90\x83\xbe\x00\xd0\x83\xbe\x00\x10\x84\xbe\x00\xd0\x84\xbe\x00\x10\x80\xbe\x00P\x80\xbe\x00\x90\x80\xbe\x00\xd0\x80\xbe\x00\x10\x81\xbe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\x81\xbe\x00\x10\x82\xbe\x00\x00\x00\x00\x00P\x81\xbe\x00\x90\x81\xbe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00P\x82\xbe\x00\x90\x82\xbe\x00\xd0\x82\xbe\x00\x10\x83\xbe\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053f598 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \x00\x00\xbd\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053fa74 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32.dll |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetModuleHandleExW FunctionAddress => 0x7c81fca9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => P\xcf\x90|\xd0\xcf\x90|\x80\xd2\x90|p\xd3\x90|\x00\xd5\x90|\xd0\xd6\x90|\xe0\xd7\x90|p\xd8\x90|\xb0\xd8\x90|`\xd9\x90|\xf0\xde\x90|\xa4\x00\x91|\x1b\xeb\x90|\x88y\x91|b\\x92|j\xdf\x92|\xced\x92|
\xff\x90|}\x98\x91|E&\x90|*\xfe\x90|\xf0\xd7\x90|\x90\xd0\x90|@\xdc\x90|\xf0\xd6\x90|\x90\xd7\x90|\xb0\xd5\x90|\xd0\xd0\x90|P\xd2\x90|\xf0\xd0\x90|\xc0\xd5\x90|`\xd1\x90|\x10\xd6\x90|\xc0\xce\x90|\x00\xd3\x90|\x00\xd2\x90|\xa0\xd7\x90|@\xd6\x90|\xe0\xd5\x90|\xf0\xd5\x90|\x00\xd6\x90| ProcessHandle => 0x000001a8 BaseAddress => 0x0053f4b8 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x0000019c FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | ZwMapViewOfSection |
SectionOffset => 0x0012f7b4 SectionHandle => 0x0000019c ProcessHandle => 0xffffffff BaseAddress => 0x019c0000 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \x0c\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053f4ac |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \x00\x00 \x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053f560 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | WriteProcessMemory |
Buffer => \x00\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053f564 |
SUCCESS | 0x00000001 | |
| 09:15:13,425 | 472 | NtCreateMutant |
Handle => 0x00000190 InitialOwner => 1 MutexName => |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c927ebb CreationFlags => 4 |
SUCCESS | 0x000001c0 | |
| 09:15:13,425 | 472 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001c0 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 1660 | NtDelayExecution |
Milliseconds => 1566804069 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x000001c8 | |
| 09:15:13,425 | 472 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001c8 |
SUCCESS | 0x00000000 | |
| 09:15:13,425 | 472 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c929b6f CreationFlags => 4 |
SUCCESS | 0x000001d4 | |
| 09:15:13,425 | 472 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x000001d4 |
SUCCESS | 0x00000000 | |
| 09:15:13,435 | 472 | WriteProcessMemory |
Buffer => \x04\x00\x00\x00 ProcessHandle => 0x000001a8 BaseAddress => 0x0053aae8 |
SUCCESS | 0x00000001 | |
| 09:15:13,435 | 472 | NtOpenFile |
ShareAccess => 3 FileName => C:\WINDOWS\system32 DesiredAccess => 0x00100020 FileHandle => 0x00000248 |
SUCCESS | 0x00000000 | |
| 09:15:13,445 | 472 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x00000194 |
SUCCESS | 0x00000000 | |
| 09:15:14,847 | 1456 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x00000194 | |
| 09:15:14,847 | 1456 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x00000194 |
SUCCESS | 0x00000000 | |
| 09:15:14,857 | 1676 | RegOpenKeyExW |
Handle => 0x00000194 Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:15:14,857 | 1676 | RegCloseKey |
Handle => 0x00000194 |
SUCCESS | 0x00000000 | |
| 09:15:14,867 | 1676 | RegCreateKeyExW |
Handle => 0x00000194 Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:14,867 | 1676 | RegCloseKey |
Handle => 0x00000194 |
SUCCESS | 0x00000000 | |
| 09:15:14,867 | 1676 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:15,148 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:15,158 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlInitUnicodeString FunctionAddress => 0x7c901295 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:15,158 | 1676 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
FAILURE | 3221225524 | |
| 09:15:15,158 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 3758293023 KeyHandle => 0x0000025c Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,158 | 1676 | NtOpenKey |
DesiredAccess => 196639 KeyHandle => 0x0000025c ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated |
SUCCESS | 0x00000000 | |
| 09:15:15,158 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Installer\Migrated DesiredAccess => 196639 KeyHandle => 0x0000025c Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,178 | 1676 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x00000000 ObjectAttributes => Language |
FAILURE | 3221225524 | |
| 09:15:15,178 | 1676 | NtCreateKey |
ObjectAttributes => Language DesiredAccess => 3758293023 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,178 | 1676 | NtCreateKey |
ObjectAttributes => UseMUI DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,208 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Language\current DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,238 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\Originals DesiredAccess => 2 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:15,668 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | 1 time |
| 09:15:15,668 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,678 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,678 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,678 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:15,678 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,678 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,678 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,688 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:15,688 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:15,688 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,688 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,688 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,688 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:15,698 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:15,698 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,698 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,698 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,698 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:15,698 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:15,698 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,698 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,889 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,889 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,889 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,889 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:15,899 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:15,899 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:15,899 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:16,790 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ExitSection DesiredAccess => 2 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:16,980 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:16,990 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:16,990 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,000 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,000 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002029a0 | |
| 09:15:17,000 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,010 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,010 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color |
SUCCESS | 0x002029a0 | |
| 09:15:17,010 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Color\ACECache11.lst DesiredAccess => 0x00120196 CreateDisposition => 5 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,010 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,010 | 1676 | NtQueryInformationFile |
FileHandle => 0x0000025c FileInformation => \x80bKQ\x8a\xa2\xcf\x01\x80bKQ\x8a\xa2\xcf\x01\x80bKQ\x8a\xa2\xcf\x01\x80bKQ\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00:L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x96\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:17,090 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | 1 time |
| 09:15:17,090 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,090 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,090 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,100 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,100 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,100 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,100 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,100 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,100 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,100 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,100 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,110 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,110 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,110 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,110 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,110 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,110 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,201 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,211 | 1676 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,271 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,271 | 1676 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,331 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,331 | 1676 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,381 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,381 | 1676 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,381 | 1676 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,381 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,381 | 1676 | NtCreateKey |
ObjectAttributes => cInstallData DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,391 | 1676 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_extensions_2E_files_5F_11_2E_0_2E_7_2E_0 DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,391 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,391 | 1676 | NtCreateKey |
ObjectAttributes => cInstallTypes DesiredAccess => 196639 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,601 | 1676 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000260 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:17,651 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com DesiredAccess => 65547 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,691 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 DesiredAccess => 65547 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,731 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 DesiredAccess => 65547 KeyHandle => 0x00000260 Class => |
SUCCESS | 0x00000000 | |
| 09:15:17,761 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,761 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,761 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,761 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,771 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,771 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,771 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,771 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,771 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,771 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,771 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,781 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,791 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,791 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002029a0 | |
| 09:15:17,791 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000025c |
SUCCESS | 0x00000000 | |
| 09:15:17,791 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000260 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000260 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000260 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:18,633 | 1676 | RegOpenKeyExA |
Handle => 0x00000260 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | RegQueryValueExA |
Handle => 0x00000260 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | RegQueryValueExA |
Handle => 0x00000260 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | RegCloseKey |
Handle => 0x00000260 |
SUCCESS | 0x00000000 | |
| 09:15:18,633 | 1676 | RegOpenKeyExA |
Handle => 0x00000260 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | RegQueryValueExA |
Handle => 0x00000260 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | RegQueryValueExA |
Handle => 0x00000260 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | RegQueryValueExA |
Handle => 0x00000260 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rsaenh.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:18,643 | 1676 | NtOpenKey |
DesiredAccess => 1 KeyHandle => 0x00000264 ObjectAttributes => \Registry\MACHINE\System\CurrentControlSet\Control\Session Manager |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtQueryValueKey |
KeyHandle => 0x00000264 ValueName => SafeProcessSearchMode |
FAILURE | 3221225524 | |
| 09:15:18,643 | 1676 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000264 FileInformation => \x000\x03\x00\x00\x00\x00\x00\x00.\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000268 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | ZwMapViewOfSection |
SectionOffset => 0x01fbf864 SectionHandle => 0x00000268 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\system32\rsaenh.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x00000268 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | ZwMapViewOfSection |
SectionOffset => 0x01fbf8c8 SectionHandle => 0x00000268 ProcessHandle => 0xffffffff BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x0e\x1f\xba\x0e\x00\xb4 \xcd!\xb8\x01L\xcd!This program cannot be run in DOS mode.
$\x00\x00\x00\x00\x00\x00\x00\x14_\xd9\x13P>\xb7@P>\xb7@P>\xb7@w\xf8\xda@H>\xb7@\x931\xb8@Y>\xb7@P>\xb6@\xc5>\xb7@\x931\xea@[>\xb7@\x931\xeb@Q>\xb7@\x931\xe9@Q>\xb7@\x931\xd7@Q>\xb7@\x931\xe8@\x7f>\xb7@\x931\xed@Q>\xb7@RichP>\xb7@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00PE\x00\x00L\x01\x04\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000264 FileInformation => P\x01\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtSetInformationFile |
FileHandle => 0x00000264 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => \x03\x00\x00\x00\x00\x00\x04\x00\x00\x10\x00\x00\x00\x00\x10\x00\x00\x10\x00\x00\x00\x00\x00\x00\x10\x00\x00\x000\xea\x02\x00\xbb\x02\x00\x00\xc4\xdd\x02\x00x\x00\x00\x00\x000\x03\x00P\x0c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x03\x00\xc8\x10\x00\x00@\x12\x00\x00\x1c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10e\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x008\x02\x00\x00\xbc\xdb\x02\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.text\x00\x00\x00\xeb\xdc\x02\x00\x00\x10\x00\x00\x00\xde\x02\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00`.data\x00\x00\x00 0\x00\x00\x00\xf0\x02\x00\x00*\x00\x00\x00\xe2\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\xc0.rsrc\x00\x00\x00P\x0c\x00\x00\x000\x03\x00\x00\x0e\x00\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => \x00\x04\x00\x08\x00\x00\x00\x08\x00\x04\x01\x00 \x04\x01\x08\x00\x00\x00\x00 \x04\x01\x00\x00\x00\x00\x08\x00\x04\x00\x00 \x00\x01\x00 \x04\x00\x08\x00\x04\x00\x00\x00\x00\x00\x00 \x04\x01\x08 \x00\x01\x08\x00\x04\x01\x08 \x04\x00\x00\x00\x00\x01\x00\x00\x04\x01\x00 \x00\x01\x08\x00\x04\x00\x08 \x04\x00\x00 \x00\x00\x00 \x04\x01\x00\x00\x00\x01\x08 \x00\x00\x08@\x00\x00\x80@\x00 \x00\x00\x00\x00\x00\x00 \x80@\x00 \x00\x00 \x00\x00@ \x00\x80\x00\x00 \x00@ \x00\x00@ \x80\x00 \x00\x00\x00\x00\x80\x00 \x00\x80@\x00\x00\x80\x00\x00 \x80@ \x00\x00\x00 \x00@ \x00\x80@\x00 \x80\x00\x00\x00\x00\x00 \x00\x00@\x00\x00\x00\x00 \x80@\x00 \x80@ \x80\x00\x00 \x80\x00\x00\x00\x80@ \x00\x00@\x00\x00\x00\x00 \x00@ \x00\x00 \x00\x80@ \x00\x00\x00\x00\x00\x80\x00 \x00\x80@ \x00\x00 \x80@\x00 \x00\x00\x00\x00\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => '\x9e\x9e\xb9\xd9\xe1\xe18\xeb\xf8\xf8\x13+\x98\x98\xb3"\x11\x113\xd2ii\xbb\xa9\xd9\xd9p\x07\x8e\x8e\x893\x94\x94\xa7-\x9b\x9b\xb6<\x1e\x1e"\x15\x87\x87\x92\xc9\xe9\xe9 \x87\xce\xceI\xaaUU\xffP((x\xa5\xdf\xdfz\x03\x8c\x8c\x8fY\xa1\xa1\xf8 \x89\x89\x80\x1a
\x17e\xbf\xbf\xda\xd7\xe6\xe61\x84BB\xc6\xd0hh\xb8\x82AA\xc3)\x99\x99\xb0Z--w\x1e\x0f\x0f\x11{\xb0\xb0\xcb\xa8TT\xfcm\xbb\xbb\xd6,\x16\x16:\xa5\xc6cc\x84\xf8||\x99\xeeww\x8d\xf6{{
\xff\xf2\xf2\xbd\xd6kk\xb1\xdeooT\x91\xc5\xc5P`00\x03\x02\x01\x01\xa9\xcegg}V++\x19\xe7\xfe\xfeb\xb5\xd7\xd7\xe6M\xab\xab\x9a\xecvvE\x8f\xca\xca\x9d\x1f\x82\x82@\x89\xc9\xc9\x87\xfa}}\x15\xef\xfa\xfa\xeb\xb2YY\xc9\x8eGG\x0b\xfb\xf0\xf0\xecA\xad\xadg\xb3\xd4\xd4\xfd_\xa2\xa2\xeaE\xaf\xaf\xbf#\x9c\x9c\xf7S\xa4\xa4\x96\xe4rr FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => m\xd6G\x13\x9a\xd7a\x8c7\xa1\x0czY\xf8\x14\x8e\xeb\x13<\x89\xce\xa9'\xee\xb7a\xc95\xe1\x1c\xe5\xedzG\xb1<\x9c\xd2\xdfYU\xf2s?\x18\x14\xceys\xc77\xbfS\xf7\xcd\xea_\xfd\xaa[\xdf=o\x14xD\xdb\x86\xca\xaf\xf3\x81\xb9h\xc4>8$4,\xc2\xa3@_\x16\x1d\xc3r\xbc\xe2%\x0c(<I\x8b\xff
\x95A9\xa8\x01q\x08\x0c\xb3\xde\xd8\xb4\xe4\x9cdV\xc1\x90{\xcb\x84a\xd52\xb6pHl\t\xd0\xb8WBPQ\xf4\xa7S~Ae\xc3\x1a\x17\xa4\x96:'^\xcb;\xabk\xf1\x1f\x9dE\xab\xac\xfaX\x93K\xe3\x03U 0\xfa\xf6\xadvm\x91\x88\xccv%\xf5\x02L\xfcO\xe5\xd7\xd7\xc5*\xcb\x80&5D\x8f\xb5b\xa3I\xde\xb1Zg%\xba\x1b\x98E\xea\x0e\xe1]\xfe\xc0\x02\xc3/u\x12\x81L\xf0\xa3\x8dF\x97\xc6k\xd3\xf9\xe7\x03\x8f_\x95\x15\x92\x9c\xeb\xbfmz\xda\x95RY-\xd4\xbe\x83\xd3Xt!)I\xe0i FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,643 | 1676 | NtReadFile |
Buffer => \xfb\x0bA.\x9a\xd7a\x8c\x94\xdel\x87\x86\xc5{\x9a\x88\xccv\x91\xa2\xf3U\xa0\xac\xfaX\xab\xbe\xe1O\xb6\xb0\xe8B\xbd\xea\x9f \xd4\xe4\x96\x04\xdf\xf6\x8d\x13\xc2\xf8\x84\x1e\xc9\xd2\xbb=\xf8\xdc\xb20\xf3\xce\xa9'\xee\xc0\xa0*\xe5zG\xb1<tN\xbc7fU\xab*h\\xa6!Bc\x85\x10Lj\x88\x1b^q\x9f\x06Px\x92
\x0f\xd9d\x04\x06\xd4o\x16\x1d\xc3r\x18\x14\xcey2+\xedH<"\xe0C.9\xf7^ 0\xfaU\xec\x9a\xb7\x01\xe2\x93\xba
\xf0\x88\xad\x17\xfe\x81\xa0\x1c\xd4\xbe\x83-\xda\xb7\x8e&\xc8\xac\x99;\xc6\xa5\x940\x9c\xd2\xdfY\x92\xdb\xd2R\x80\xc0\xc5O\x8e\xc9\xc8D\xa4\xf6\xebu\xaa\xff\xe6~\xb8\xe4\xf1c\xb6\xed\xfch\x0c
g\xb1\x02\x03j\xba\x10\x18}\xa7\x1e\x11p\xac4.S\x9d:'^\x96(<I\x8b&5D\x80|B\x0f\xe9rK\x02\xe2`P\x15\xffnY\x18\xf4Df;\xc5Jo6\xceXt!\xd3 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xce>'\xca\x07\xc2\xc0!\xc7\xb8\x86\xd1\x1e\xeb\xe0\xcd\xd6}\xda\xeax\xd1n\xee\x7fO}\xf5\xbao\x17r\xaag\xf0\x06\xa6\x98\xc8\xa2\xc5}c
\xae
\xf9\xbe\x04\x98?\x11\x1bG\x1c\x135\x0bq\x1b\x84}\x04#\xf5w\xdb(\x93$\xc7@{\xab\xca2\xbc\xbe\xc9\x15
\xbe\x9e<L
\x10\x9c\xc4g\x1dC\xb6B>\xcb\xbe\xd4\xc5L*~e\xfc\x9c)\x7fY\xec\xfa\xd6:\xabo\xcb_\x17XGJ\x8c\x19Dl\x98/\x8aB\x91D7q\xcf\xfb\xc0\xb5\xa5\xdb\xb5\xe9[\xc2V9\xf1\x11\xf1Y\xa4\x82?\x92\xd5^\x1c\xab\x98\xaa\x07\xd8\x01[\x83\x12\xbe\x851$\xc3}\x0cUt]\xber\xfe\xb1\xde\x80\xa7\x06\xdc\x9bt\xf1\x9b\xc1\xc1i\x9b\xe4\x86G\xbe\xef\xc6\x9d\xc1\x0f\xcc\xa1\x0c$o,\xe9-\xaa\x84tJ\xdc\xa9\xb0\\xda\x88\xf9vRQ>\x98m\xc61\xa8\xc8'\x03\xb0\xc7\x7fY\xbf\xf3\x0b\xe0\xc6G\x91\xa7\xd5Qc\xca\x06g))\x14\x85
\xb7' FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00\x00\x00\xffu\x18\xffu\x14\xffu\x10\xffvxVh\x90\x98\x01h\xe8\xcb\xf9\xff\xff\x85\xc0\x0f\x85\xc0\x00\x00\x009E\x10\x0f\x84\xb5\x00\x00\x00\x8bE\x0c\x85\xc0\x0f\x84\xaa\x00\x00\x00\x81x\x04\x05\x80\x00\x00\x0f\x85\x9d\x00\x00\x00\x83~`\x01\x0f\x85\x93\x00\x00\x00\x8bNxW\x8bx\x10\x8b\xd1\x83\xc7\x04\xc1\xe9\x02\x83\xc6,\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4_\xebq\xb8\x08\x00 \x80\xebp\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xa0t\x01h\xeb$\xffu\x18\xffu\x14\xffu\x10j\x08Vh\xd0f\x01h\xeb\x11\xffu\x18\xffu\x14\xffu\x10j\x08Vh V\x01h\xe87\xf9\xff\xff\x85\xc0u09E\x10t)\x8bE\x0c\x85\xc0t"\x81x\x04\x05\x80\x00\x00u\x19\x83~`\x01u\x13\x8bV,\x8bH\x10\x89Q\x04\x8bV0\x89Q\x08\x83H4\x013\xc0^]\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x14V3\xf6\xf7E\x18\xbf\xff\xff\xff\x89u FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => v\x81\xf9\x02f\x00\x00tX\x81\xf9\x03f\x00\x00t:\x81\xf9 f\x00\x00t2\x81\xf9
f\x00\x00vl\x81\xf9\x10f\x00\x00wd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00\xffpxPh\x90\x98\x01h\xe8\xfe\xe7\xff\xff\x85\xc0tF\x8b\xf0\xebf\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xa0t\x01h\xeb\xdd\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph\xd0f\x01h\xeb\xc7\xffu\x14\x8dM\xf0Q\xffu\xf4j\x00j\x08Ph V\x01h\xeb\xb1\x8bu\xf0\x8bE\x10\x8bU\xec\x03\xf2\x8b\xc8\x8b\xd1\xc1\xe9\x02\x8d{\x14\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x89\x033\xff3\xf6\x83}\xf4\x00t\x08\xffu\xf4\xe8\xf0\xa0\x01\x00\x8bE\xfc\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8bE\xf8\x85\xc0t\x12\x83\xc0\xf8\x818Heapu\x07P\xff\x15\x1c \x03h\x8b\xc6\x8de\xe0_^[\xc9\xc2\x10\x00\xcc\xcc\xcc FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xe9\x02\xf3\xa5\x8b\xc8\x8bE\xfc\x83\xe1\x03\xf3\xa4\x8bu\x08\x03\xc3\x01E\x14\x8b}\x14\x8b\xcb\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\x08\x83\xe1\x03\xf3\xa4\x8bJ\x04\x8d4\x18\x8bE\x14\xc1\xe9\x03\x8d<\x18\x03}\xfc\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x8bE\xf4\x83\xc0\xecP\xffu\x0c\x83\xe1\x03\xf3\xa4\xe8\x9f\x91\x01\x00\x85\xc0t\x043\xc0\xeb&\x8b}\xf0\x8bu\xf43\xc0@\x8bM\x18\x899\x8bM\x10\x891\xeb\x113\xc0\xeb\xf0\x8bE\x18\x898\x8bE\x10\x8903\xc0@_[^\xc9\xc2\x14\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c%\x00\xe0\x00\x00=\x00\x80\x00\x00u\x043\xc0\xeb\x1a\x8bE\x08\x8b\x80\x84\x01\x00\x00j\x00\xffu\x0c\xff4\x85(\x18\x03h\xe8c\xe1\x01\x00]\xc2\x08\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x0c\x8bM\x14W3\xff-\x00$\x00\x00\x899t\x19-\x01(\x00\x00td\x83\xe8\x03tTHtFHtY-\xfaW\x00\x00u\x06 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xfa\x10f\x00\x00w\x05\x8bIx\xeb\x8a\x83&\x00\xebA\xc7\x06@\x00\x00\x00\xeb9\x8bM\x1c\x8bI\x10\x85\xc9u\x07\xb9
\x00 \x80\xeb:\x8bI\x08\x89\x0e\xeb!\xf7\xde\x1b\xf6\x81\xe6\xea\x00\x00\x00\x8b\xce\xeb#\x8bM\x14\x85\xc9t\x129\x18r\x0e\x8bU\x1c\x8bR\x04\x89\x11\x89\x183\xc9\xeb\x0c\xf7\xd9\x1b\xc9\x81\xe1\xea\x00\x00\x00\x89\x18_[3\xc0\x85\xc9\x0f\x94\xc0\x8b\xf0\x85\xf6u\x07Q\xff\x15\xc4\x11\x00h\x8b\xc6^]\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSV\x8bu\x083\xc0\xf6\x06 Wt\x01@\x83}\x0c\x02u\x13\xbb\x84\x12\x00h\xbf|\x12\x00h\xc7E\x08t\x12\x00h\xeb\x17\x83}\x0c\x01uP\xbbl\x12\x00h\xbfd\x12\x00h\xc7E\x08\\x12\x00h\x83\xbeX\x01\x00\x00\x00t\x15j\x00P\xffu\x0ch\xb0\x1a\x03hV\xe8\xcb\xab\x00\x00\x85\xc0u&W\x8b=\xc4\x10\x00h\x81\xc6@\x01\x00\x00\xff6\xff\xd7\xffu\x08\xff6\xff\xd7S FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x8bu \x85\xf6t\x1d3\xc9;\xc1v\x17\x8dE\xdc+\xf0\x8dD
\xdc\x8a\x1c\x060\x18A;M\x18r\xf1\x8b]\xd8\x8b}\x08\x81\xff\x01f\x00\x00\x0f\x84\xf1\x00\x00\x00\x81\xff\x02f\x00\x00\x0f\x84\xbc\x00\x00\x00\x81\xff\x03f\x00\x00\x0f\x84\x87\x00\x00\x00\x81\xff f\x00\x00t\x7f\x81\xff
f\x00\x00vm\x81\xff\x10f\x00\x00v6;\xfaua\x8bM\x18\x8bu\xd0\x8b\xc1\xc1\xe9\x02\x83}$\x01\x8d}\xect\x03\x8bu\xd4\xf3\xa5\x8b\xc8\x8dE\xecP\xffu\x18\x83\xe1\x03S\xf3\xa4\xe8\x18\xec\x00\x00\xe9\xb2\x00\x00\x00\x83}$\x01u\x15j\x01S\x8dE\xdcP\x8dE\xecP\xe8\x8d\xea\x00\x00\xe9\x9d\x00\x00\x00j\x00S\xffu\xd4\x8dE\xecP\xe8y\xea\x00\x00\xe9\x83\x00\x00\x00\xbe\x08\x00 \x80\xe9\xc7\x00\x00\x00\x83}$\x01u\x12j\x01S\x8dE\xdcP\x8dE\xecP\xe8d\xc6\x00\x00\xebgj\x00S\xffu\xd4\x8dE\xecP\xe8S\xc6\x00\x00\xebP\x83}$\x01u FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x01\x00\x00\x8dE\xf4PV\xffu\x18\xe8\xcd\xcb\xff\xff\x85\xc0\x0f\x84D\x01\x00\x009u\xf0\x8bE\xf4\x8bM\x14\x8d<\x01u\x17W\xe8@a\x01\x00\x8b\xd8;\xde\x89]\xecu\x11j\x08^\xe9\xb6\x01\x00\x00\x8b]\xf8\x83\xc3\x08\x89]\xec\x8dE\xf4PS\xffu\x18\xe8\x8a\xcb\xff\xff\x85\xc0\x0f\x84\x01\x01\x00\x009u\x10t\x1eVW\x8dE\xf4PSVj\x01V\xffu\x10\xffu\x08\xe8\xd4\xab\xff\xff;\xc6\x0f\x85\xb8\xfd\xff\xff\x83}\xf0\x00\x8bM\xf4\x8dY\x08\x0f\x85<\x01\x00\x00\x8b}\x1c\x8bu\xec\x83\xc7\x08\xe96\x01\x00\x00\x8a\x06<\x03t\x08<\x04\x0f\x85\xb2\x00\x00\x00\x8bE\xfc\x8b@\x10\x85\xc0\x0f\x84\xb8\x00\x00\x00\x8bX\x08\x8bu\x1c\x83\xc3\x07\xc1\xeb\x03\x83\xc3\x14\x85\xf6\x0f\x84\x15\x01\x00\x00\x8bM 9\x19\x0f\x82
\x01\x00\x00\x8b\x08\x8bU\xf8\x89J\x08\x8bH\x08\x89J\x0c\x8bH\x10\x89J\x10\x8bH\x08\x83\xc1\x07\xc1\xe9\x03\x8dp\x14\x8b\xc1\xc1\xe9\x02\x8d FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => k\x83E\x90\x08u2\x8b\xb5|\xff\xff\xff\x8dF\x08;\xc6r\x18P\xff\x15\x18 \x03h;\xc7\x89E\x90t\x0f\xc7\x00Heap\x83E\x90\x089}\x90u\x08j\x08[\xe9\x85\x02\x00\x00\x8d\x85|\xff\xff\xffP\x8dE\x90P\x8bE\x94\xffp\x1c\xe8\x8d\xa5\xff\xff;\xc7\x0f\x85c\xfc\xff\xff\xffu\x88\x8bE\x94\xffu\x98\xffu\x90\xffp\x1c\xe8x\xa9\xff\xff;\xc7\x0f\x85G\xfc\xff\xff\xff\xb5t\xff\xff\xff\x8dE\x9cP\xffu\x90\x8bE\x94\xffp\x1c\xe8X\xa9\xff\xff;\xc7\x0f\x85'\xfc\xff\xff\x8bE\x94\x8bx\x10\x8b\x8d|\xff\xff\xff\x8bu\x90\x8b\xc1\xc1\xe9\x02\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\x94\x83H \x02\x8bM\x80\x8b}\x8c\x8b\xd1\xc1\xe9\x02\x8b\xb5x\xff\xff\xff3\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bM\x88\x8b}\x98\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x94VS\xffp\x10\xffp\x18\xffp\x1c\xe8\x94\xf8\xff\xff\x85\xc0\xe9\xb1 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xeb\x07\xc7E\xb8p\xf0\x02h\x8bU\x143\xf6\x85\xd2v\x13\x8bE\x10\x8dD\x10\xff\x8a\x08\x88L5\xbcFH;\xf2r\xf4\x8b]\x1c\x8b\xca\x8b\xfb\x8du\xbc3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0u~\xf6E\x18\x01\x8b\xca\x89M\xb4uG\x8bu\xb8\x85\xf6t@\x8b\x06\x808\x00t9\x89u\xb8\x0f\xb6\x18\x8dx\x01\x8bE\x1c\x8d4\x02\x8b\xcb3\xc0\xf3\xa6t\x05\x1b\xc0\x83\xd8\xff\x85\xc0t\x13\x83E\xb8\x04\x8bE\xb8\x8b\x00\x808\x00u\xd5\x8bM\xb4\xeb\x03\x8d\x0c\x13\x8b]\x1c\x80<\x19\x00u&\x8bE\x08\x8b@\x0c\x80<\x18\x00u\x1a\x80|\x18\xff\x01u\x13AH\xeb\x07\x80<\x19\xffu A;\xc8r\xf53\xc0\xeb\x0c\xb8\x06\x00 \x80\xeb\x05\xb8\x02\x00 \x80\x8bM\xfc_^[\xe8\x92n\x00\x00\xc9\xc2\x18\x00\x10\xdd\x00h\x19\xdd\x00h"\xdd\x00h+\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17\xde\x00h4\xdd\x00h\x17\xde\x00h\x17\xde\x00h\x17 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => _j\x06\x8dM\xc0Q\x8dM\xe4Q\xffu\xc8\x89}\xc0P\xffU\xb8;\xc3u\x06f9}\xc0t8\x83\xf82\x8bu\xcctSW\x8dE\xe4P\x8dF8P\x8dFXP\x8d\x86d\x01\x00\x00P\xe8\xb7\xe9\xff\xff;\xc3uSSj\x06W\x8dE\xe4P\xffu\xc8\xffu\xd4\xffU\xc4\xeb\x03\x8bu\xccW\xe8\x0c1\x01\x00;\xc3\x89\x86H\x01\x00\x00u\x08j\x08^\xe9\x1a\x01\x00\x00\x8du\xe4\xe9\xff\x00\x00\x00\x8dE\xd8PSSh\x03\x80\x00\x00\xffv\x0c\xe8\xd9\x86\xff\xff\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf0\xe9\xee\x00\x00\x00S\x8dE\xecPj\x02\xffu\xd8\xffv\x0c\xe8k\xb7\xff\xff\x85\xc0t\xdd\x8dE\xbcPj\x01\xffv\x0c\xffu\xd8\xe8\xf0$\x00\x00;\xc3t\x11= \x00 \x80u\xc7\xbe\x02\x00 \x80\xe9\xb2\x00\x00\x00\x8bE\xbc\xffu\xd0\x8b=\xbc\x11\x00h\x83`\x18\xfe\xff\xd7@P\xe8y0\x01\x00;\xc3\x89E\xe0tw\xffu\xd0P\xff\x15 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xff\xff\xff6\xe8\xcc!\x01\x00\x8bu\x18\x89\x06\x8bE\x10\xff0\xe8T!\x01\x00;\xc3\x89\x07\x0f\x84r\xff\xff\xff\xff6\xe8C!\x01\x00;\xc3\x8bM\x0c\x89\x01\x0f\x84^\xff\xff\xff\xffu\xf0\xffu\xf8h\x01\x00\x01\x00\xffu\x1cP\xff7\xe8 \xfc\x00\x00\x8b\xf0\xf7\xde\x1b\xf6\x81\xe6\xb1\xfa\xff\xff\x81\xc6O\x05\x00\x00\x8dE\xdcP\x8d\x85p\xff\xff\xffP\xe8\xfbz\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xf6F\x00\x00\x8b\xf09]\xd0t"\x8dE\xdcP\x8d\x85\xc0\xfe\xff\xffP\xe8\xaev\x01\x00\x85\xc0u\x0e;\xf3u
\xffu\xe4\xe8\xcfF\x00\x00\x8b\xf09]\xect\x08\xffu\xec\xe8\xfb \x01\x009]\xf8t\x08\xffu\xf8\xe8\xee \x01\x009]\xf0t\x08\xffu\xf0\xe8\xe1 \x01\x00;\xf3t\x1b\x8b?;\xfbt\x06W\xe8\xd1 \x01\x00\x8bE\x0c\x8b\x00;\xc3t\x06P\xe8\xc2 \x01\x00_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xdbC\x89]\xa8\x8bE\x18=\x00\x04\x00\x00r0P\x8dE\xccP\x8dE\xc8P\x8dE\xc4P\x8dE\xdcP\x8dE\xe0P\xe8\\xee\xff\xff\x89E\xe4\x85\xc0\x0f\x85\xfd\x01\x00\x00\x89]\xd0\x8b}\xdc\xe9\x8f\x00\x00\x00\x89E\xa4\x8dE\xa4P\x8dE\xc8P\x8dE\xc4P\xe8\xa9\xef\x00\x00\x85\xc0u\x0c\xc7E\xe4 \x00 \x80\xe9\xce\x01\x00\x00\xffu\xc4\xe8\x01\x11\x01\x00\x89E\xe0\x85\xc0u\x0c\xc7E\xe4\x08\x00\x00\x00\xe9\xb3\x01\x00\x00\x89]\xd0\xffu\xc8\xe8L\x11\x01\x00\x89E\xccP\xe8\xda\x10\x01\x00\x8b\xf8\x89}\xdc\x85\xfft\xd7\x8d\x86d\x01\x00\x00\x838\xfft\x10\x89E\x90\xc7E\x94o\xd7\x00h\x8dE\x90\x89E\xc0h\x01\x00\x01\x00\xffu\x18W\xffu\xe0\xffu\xc0\xe8\xf2\xe8\x00\x00\x85\xc0t\x89\x8bE\xcc\x83\xc0\xecP\x8dG\x14P\xe8\x1c\x11\x01\x00\x89E\xd8\x85\xc0\x0f\x85E\x01\x00\x00PSSW\xffu\xe0\xe8s\xfc\xff\xff\x89E\xd8\x85\xc0\x0f\x85.\x01\x00\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x85\xe2\x00\x00\x00\xe8\x1f\xf7\xff\xff\x85\xc0\x0f\x84\xd5\x00\x00\x00\x8d\x85\xa4\xfe\xff\xffP\xe8\x8e\x80\x00\x00j\x03h\x1c\xf8\x02h\x8d\x85\xa4\xfe\xff\xffP\xe8K\x8c\x00\x00\x8d\x85|\xff\xff\xffP\x8d\x85\xa4\xfe\xff\xffP\xe8h\x8d\x00\x00\x8b\xcb\xbf \xf8\x02h\x8d\xb5|\xff\xff\xff3\xc0\xf3\xa7\x0f\x85\x8c\x00\x00\x00\x8d\x85\xd4\xfd\xff\xffP\xe85\x8e\x00\x00j\x03h@\xf8\x02h\x8d\x85\xd4\xfd\xff\xffP\xe8R\xbd\x00\x00\x8d\x85L\xff\xff\xffP\x8d\x85\xd4\xfd\xff\xffP\xe8\xbf\xc5\x00\x00j\x0cY\xbfD\xf8\x02h\x8d\xb5L\xff\xff\xff3\xc0\xf3\xa7uF\x8d\x85\x04\xfd\xff\xffP\xe8\x7f\x8e\x00\x00j\x03ht\xf8\x02h\x8d\x85\x04\xfd\xff\xffP\xe8\x0c\xbd\x00\x00\x8d\x85\x0c\xff\xff\xffP\x8d\x85\x04\xfd\xff\xffP\xe8Y\xbe\x00\x00j\x10Y\xbfx\xf8\x02h\x8d\xb5\x0c\xff\xff\xff3\xc0\xf3\xa7t
\xb8 \x00 \x80\xe9\xfa\x01\x00\x00j\x00h\x8c\xf6\x02hj\x05h\x84\xf6\x02hj FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03\x00\x00\x89H\x10\x8b\x8bX\x03\x00\x00\x89H\x14\x8b\x8b\\x03\x00\x00\x89H\x18\x8b\x8b4\x01\x00\x00\x89\x88\x1c\x01\x00\x00\x8b\xd1\xc1\xe9\x02\x8ds4\x8dx\x1c\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8b8\x02\x00\x00\x89\x88 \x02\x00\x00\x8b\xd1\xc1\xe9\x02\x8d\xb38\x01\x00\x00\x8d\xb8 \x01\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bD\x03\x00\x00\x89\x88,\x03\x00\x00\x8d\xb8,\x02\x00\x00\x8b\xc1\xc1\xe9\x02\x8d\xb3D\x02\x00\x00\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\xe9\x1b\x02\x00\x00\x8bJ\x0c\x89\x880\x04\x00\x00\x8br\x10\x8b\xd1\xc1\xe9\x02\x8d\xb80\x03\x00\x00\xf3\xa5\x8b\xca\x83\xe1\x03\xf3\xa4\x8b\x8bH\x03\x00\x00\x89H\x04\x8b\x8bL\x03\x00\x00\x89H\x08\x8b\x8bP\x03\x00\x00\x89H\x0c\x8b\x8bT\x03 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00+\xc1\x89u\xcc\x89U\xd8\x89U\xd0\x89U\xc4\x89U\xc0\x0f\x84H\x01\x00\x00\x83\xe8\x04t
\xbe\x08\x00 \x80\xe9\x97\x01\x00\x00\xf6\x834\x04\x00\x00\x01\x8b{\x0c\x8bC\x04\x89}\xd4\x89E\xc8\x0f\x84\xcd\x00\x00\x00\xffu\x14\x8dE\xf4P\x8dE\xd0P\x8dE\xdcP\x8dE\xccP\x8dE\xd4P\x8dE\xc4PS\xe8<\xfe\xff\xff\x85\xc0\x0f\x852\x01\x00\x00\x8bE\xcc\xf6E\x14\x01t\x07\xc7E\xc0\x01\x00\x00\x00\x8dM\xd8Qj\x01j\x00P\xff6W\xffu\xc0\xffu\xc8\xe8\xf8G\xff\xff\x85\xc0\x0f\x85\x03\x01\x00\x00\x81}\xc8\x02f\x00\x00u
\x8bE\xd8\xc7@l\x80\x00\x00\x00\x8b}\xd8\x8bM\xd0\x8b\xc1\xc1\xe9\x02\x83\xc7D\x8du\xdc\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bE\xd8\x8bM\xd0\x89H@\x8b[\x18\x85\xdbt\x19\x8b}\xd8\x8b\xcb\x8b\xc1\xc1\xe9\x02\x83\xc7\x1c\x8du\xf4\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4j\x00\xffu\xd8\xffu\xbc\xe8\xdbI\xff\xff\x85\xc0\x0f\x85\x85 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x8b@\xfc\x89\x85\xdc\xfd\xff\xffj\x14Y3\xc0\x8d\xbd\xd0\xfc\xff\xff\xf3\xab\xc7\x85\xd0\xfc\xff\xff \x04\x00\xc0\x8bE\x04\x89\x85\xdc\xfc\xff\xff\x8d\x85\xd0\xfc\xff\xff\x89E\xf8\x8d\x85(\xfd\xff\xff\x89E\xfc\xa1\x84\x18\x03h\x89\x85 \xfd\xff\xff\xa1\x80\x18\x03h\x89\x85$\xfd\xff\xffj\x00\xff\x15\xd4\x10\x00h\x8dE\xf8P\xff\x15\xd8\x10\x00hh\x02\x05\x00\x00\xff\x15\xdc\x10\x00hP\xff\x15\xe0\x10\x00h_\xc9\xc3\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xf69u\x0cu\x0e95\x9c\x1a\x03h~-\xff
\x9c\x1a\x03h\x83}\x0c\x01\xa1\xf0\x11\x00h\x8b\x00\xa3\x00 \x03hu=h\x80\x00\x00\x00\xff\x15\xec\x11\x00h;\xc6Y\xa3\x08 \x03hu\x043\xc0\xebg\x890\xa1\x08 \x03hh\x08\xf0\x02hh\x00\xf0\x02h\xa3\x04 \x03h\xe8\xac\x01\x00\x00\xff\x05\x9c\x1a\x03hY\xeb?9u\x0cu;\xa1\x08 \x03h;\xc6t2\xeb\x13\x8b
\x04 \x03h\x8b ; FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => t3\xc63\xd6%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xfd\x8b\xa9\xb8\x1a\x00h3\xfd\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xfd\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xfd\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xfb\x8b\x99\xb8\x1f\x00h3\xfb\x8b\x98\xb8\x1c\x00h3\xfb\x8b\x9a\xb8\x1d\x00h3\xfb\x8bEx3\xdb\x8bU|3\xc73\xd7%\xfc\xfc\xfc\xfc\x81\xe2\xcf\xcf\xcf\xcf\x8a\xd8\x8a\xcc\xc1\xca\x04\x8b\xab\xb8\x18\x00h\x8a\xda3\xf5\x8b\xa9\xb8\x1a\x00h3\xf5\x8a\xce\xc1\xe8\x10\x8b\xab\xb8\x19\x00h3\xf5\x8a\xdc\xc1\xea\x10\x8b\xa9\xb8\x1b\x00h3\xf5\x8bl$\x1c\x8a\xce%\xff\x00\x00\x00\x81\xe2\xff\x00\x00\x00\x8b\x9b\xb8\x1e\x00h3\xf3\x8b\x99\xb8\x1f\x00h3\xf3\x8b\x98\xb8\x1c\x00h3\xf3\x8b\x9a\xb8\x1d\x00h3\xf3\x8bT$\x14\xd1\xce\x8b\xc73\xfe\x81\xe7\xaa\xaa\xaa\xaa3 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\x8b\xc7\xf7\xd0\x8b\xef#\xc1#\xea\x03\xd8\x8b\x06\x03\xdd\x03\xd8\xc1\xe8\x10\x8b\xef\x03\xc83\xc0f\xd1\xc3f\x8b\xc3#\xe8\x83\xf0\xff#\xc2\x03\xcd\x03\xc83\xc0f\xc1\xc1\x02f\x8b\xc1\x8b\xe8\x83\xf0\xff#\xeb#\xc7\x03\xd0\x8bF\x04\x03\xd0\xc1\xe8\x10\x03\xd5\x03\xf83\xc0f\xc1\xc2\x03f\x8b\xc2\x8b\xe8\x83\xf0\xff#\xc3#\xe9\x03\xf8\x03\xfd\x83\xc6\x08f\xc1\xc7\x05\xe9h\x06\x00\x00\x8d\xa4$\x00\x00\x00\x00\x90\x83\xc6xf\xc1\xcf\x05\x8b\xc2\x8b\xea\x83\xf0\xff#\xe9#\xc3f\xc1\xca\x03\x03\xc5+\xf8\x8bF\x04\x8b\xe9+\xd0\xc1\xe8\x10+\xf8\x8b\xc1\xf7\xd5#\xc3#\xef\x03\xe8f\xc1\xc9\x02+\xd5\x8b\xc3\x8b\xef\xf7\xd0#\xeb#\xc2f\xd1\xcb\x03 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => h34\x9d\xd81\x00h\x8b]\xf8\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf434\x9d\xd8)\x00h\x0f\xb6]\xf2\x89p\x08\x0f\xb6u\xf7\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x0f\xb6\xd6\x8b\x1c\x95\xd8-\x00h\x0f\xb6U\xf83\xf334\x95\xd8)\x00h\x8bX\x04\x89p\x0c\x8b0\x8bQ\x083\xd6\x8bq\x0c3\xf3\x8bX\x08\x89u\xf0\x8bq\x103\xf3\x8bX\x0c\x89u\xf4\x8bq\x14\x89U\xec3\xf3\x89u\xf8\x8b]\xf4\xc1\xee\x18\x8b4\xb5\xd85\x00h\xc1\xeb\x10\x0f\xb6\xdb34\x9d\xd81\x00h\x8b]\xf0\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6\xda34\x9d\xd8)\x00h\x8b]\xf8\x890\xc1\xeb\x10\x0f\xb6\xdb\x8b\xf2\xc1\xee\x18\x8b4\xb5\xd85\x00h34\x9d\xd81\x00h\x8b]\xf4\xc1\xeb\x08\x0f\xb6\xdb34\x9d\xd8-\x00h\x0f\xb6]\xf034\x9d\xd8)\x00h\x0f\xb6]\xee\x89p\x04\x8bu\xf0\xc1\xee\x18\x8b4\xb5\xd85 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xc7E\xe8\x02\x00\x00\x00\xeb\x03\x8dI\x00\x8bQ\xf83\x10\x8bq\xfc3p\x04\x89u\xf0\x8b9\x8bp\x083\xf7\x89u\xf4\x8bY\x043X\x0c\x8bu\xf0\x0f\xb6}\xf6\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xff34\xbd\xd8=\x00h\x0f\xb6\xfa34\xbd\xd89\x00h\x89U\xec\x890\x8bu\xf4\xc1\xee\x18\x8b4\xb5\xd8E\x00h\x89]\xf8\x0f\xb6}\xfa34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf03\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xee\x89p\x04\x8b\xf3\xc1\xee\x18\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd6\x8b<\x95\xd8=\x00h\x8bU\xf43\xf7\x0f\xb6\xfa34\xbd\xd89\x00h\x0f\xb6}\xf2\x89p\x08\x0f\xb6u\xef\x8b4\xb5\xd8E\x00h34\xbd\xd8A\x00h\x0f\xb6\xd634\x95\xd8=\x00h\x0f\xb6\xd3\x8b<\x95\xd89\x00h\x8bX\x043\xf7\x8bx\x08\x89p\x0c\x8b0\x8bQ\xe83 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xc8\x8b\xf1\xc1\xe9\x02\x8d|\x05\xbc3\xc0\xf3\xab\x8b\xce\x83\xe1\x03\xf3\xaa\x8b]\xb4\x8bu\xb8\xb9\x07\x00\x00\x00+\xcb\x8a\\x15\xbc\xb8\x01\x00\x00\x00\xd3\xe0\x8a\xc8\xfe\xc9
\xd8\xf6\xd1"\xcb\x83\xfa7\x88L\x15\xbc[v6\x8dU\xbcRV\xe8\x91a\x00\x003\xc0\x89E\xbc\x89E\xc0\x89E\xc4\x89E\xc8\x89E\xcc\x89E\xd0\x89E\xd4\x89E\xd8\x89E\xdc\x89E\xe0\x89E\xe4\x89E\xe8\x89E\xec\x89E\xf0\x8bN\x10\x8bV\x14\x8dE\xbcPV\x89M\xf4\x89U\xf8\xe8Oa\x00\x00\x8bM\xfc_\xc7F\x18\x01\x00\x00\x003\xc0^\xe8\xc5\xae\xff\xff\x8b\xe5]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x8bE\x083\xc9\xc7\x00g\xe6 j\xc7@\x04\x85\xaeg\xbb\xc7@\x08r\xf3n<\xc7@\x0c:\xf5O\xa5\xc7@\x10\x7fR\x0eQ\xc7@\x14\x8ch\x05\x9b\xc7@\x18\xab\xd9\x83\x1f\xc7@\x1c\x19\xcd\xe0[\x89H \x89H$]\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xff\xff\x89}\xd8\x8bx\x1c\x89\x95<\xfc\xff\xff\x89U\xb4\x8bP \x89\xbd@\xfc\xff\xff\x89}\xb8\x8bx$\x89\x95|\xfc\xff\xff\x89U\xdc\x8bP(\x89\xbd\x80\xfc\xff\xff\x89}\xe0\x8bx,\x89\x95L\xfc\xff\xff\x89U\xbc\x8bP0\x89\x8d\x9c\xfc\xff\xff\x89M\xcc\x8bH\x0c\x89\xbdP\xfc\xff\xff\x89}\xc0\x8bx4\x89\x95l\xfc\xff\xff\x89U\xc4\x8bP8\x8b@<\x89\x850\xfc\xff\xff\x89E\xf0\x89\x8d`\xfc\xff\xff\x89\xbdp\xfc\xff\xff\x89}\xc8\x89\x95,\xfc\xff\xff\x89U\xec3\xc0\xeb\x03\x8bu\x0c\x8b\x1e\x8bV\x04\x83\xc6\x08\x89u\x0c3\xf6\x0b\xd63\xff\x0b\xfb\x8b\xda\x89]\x94\x89}\x98\x8b\xf7\x0f\xa4\xdf\x08\x0f\xac\xf2\x08\xc1\xe3\x083\xd3\x8b]\x98\xc1\xee\x083\xf7\x8b}\x94\x0f\xa4\xfb\x08\x81\xe2\xff\x00\xff\x00\xc1\xe7\x083\xd7\x8b\xfa\x89U\x94\x81\xe6\xff\x00\xff\x003\xf3\x8b\xde\x0f\xac\xdf\x10\xc1\xeb\x10\x89u\x98\x0f\xa4\xd6\x103\xde\x8bu\x98\xc1\xe2\x103\xfa\x8bU FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xcc\x89\x8d\x88\xfc\xff\xff\x8b\xce\xf7\xd1#\xcb\x8b]\xd0\xf7\xd2#\xd3\x8b]\xec#\xde\x8bu\xf0#u\xc83\xcb\x8b\x9dp\xfe\xff\xff3\xd63\xbdl\xfe\xff\xff\x8b\xb5\x88\xfc\xff\xff3\xf33\xbd\\xfe\xff\xff3\xb5`\xfe\xff\xff\x8b\x1c\xc5T[\x00h\x03\xcf\x8b\xbc\xc5\xac\xfc\xff\xff\x13\xd6\x03\x0c\xc5P[\x00h\x8b\xb4\xc5\xb0\xfc\xff\xff\x13\xd3\x8b]\xa4\x03\xcf\x8b}\xa8\x13\xd6\x8bu\xbc\x03\xcb\x13\xd7\x03\xf1\x89M\xe4\x8bM\xc0\x13\xca\x89u\xbc\x89U\xe8\x8bU\xd8\x89M\xc0\x8bM\xd4\x8b\xf2\x8b\xf9\x0f\xac\xf7\x1c\x0f\xac\xce\x1c\x89\xb5P\xfe\xff\xff\x8b\xf2\x89\xbdL\xfe\xff\xff\x8b\xfe\x8b\xf1\x89}\xfc\x0f\xac\xf7\x02\x89\xbdt\xfc\xff\xff\x8b\xfa\x0f\xac\xfe\x02\x8b\xbdt\xfc\xff\xff\x89\xb50\xfe\xff\xff\x89\xbd,\xfe\xff\xff\x8b\xf2\x8b\xfa\x8b\xdf\x8b\xf1\x0f\xac\xf3\x07\x0f\xac\xfe\x07\x89\x9d<\xfe\xff\xff\x8b]\xb83\xda#]\xe0\x89\xb5@\xfe\xff\xff\x8bu\xb4\x8b\xfe#\xf13\xf9# FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xbc\x8b\xd6\x8b\xf9\x0f\xac\xd7\x1c\x0f\xac\xca\x1c\x89\x95H\xfe\xff\xff\x89\xbdD\xfe\xff\xff\x8b\xd6\x8b\xfe\x89}\xf8\x8b\xd1\x0f\xac\xd7\x02\x89\xbd\xb4\xfa\xff\xff\x8b\xfe\x0f\xac\xfa\x02\x8b\xbd\xb4\xfa\xff\xff\x89\x95\xb8\xfe\xff\xff\x8b\xd6\x89\xbd\xb4\xfe\xff\xff\x8b\xfa\x8b\xd1\x8b\xdf\x0f\xac\xd3\x07\x0f\xac\xfa\x07\x89\x9d\x04\xfe\xff\xff\x8b]\xc83\xde#]\xf0\x89\x95\x08\xfe\xff\xff\x8bU\xc4\x8b\xfa#\xd13\xf9#}\xec\x8bM\xc83\xfa\x8b\x95\xb4\xfe\xff\xff#\xce3\xd9\x8b\x8d\x04\xfe\xff\xff3\xca3\x8dD\xfe\xff\xff\x8b\x95\x08\xfe\xff\xff3\x95\xb8\xfe\xff\xff3\x95H\xfe\xff\xff\x03\xf9\x13\xda\x8bU\xe4\x8bM\xe8\x03\xfa\x13\xd9\x8bM\xfc\x89]\xe0\x8b]\x0c\x89}\xdc\x8b}\xa0@AC\x89M\xfc\x89]\x0c\x83\xe1\x0f\x8b\x94\xcd\xac\xfc\xff\xff\x8b\x8c\xcd\xb0\xfc\xff\xffG\x8b\xda\x89}\xa0\x8b\xf9\x0f\xac\xfb\x01\x89\x9dT\xfb\xff\xff\x8b\xda\x0f\xac\xdf\x01\x8b\x9dT\xfb\xff\xff\x89\x9d\xc4\xfe\xff\xff\x8b\xda FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff\xc1\xef\x103\xf9\x8b\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x10\x81\xe2\xff\xff\x00\x003\xd0\x8b\x85P\xff\xff\xff\x81\xe7\xff\xff\x00\x003\xf9\xc6\x85l\xff\xff\xff\x80\x89\x94\x05\\xff\xff\xff\x89\xbc\x05`\xff\xff\xff\x8b\xbdh\xff\xff\xff3\xc0\x0b\xf8\x8b\x85d\xff\xff\xff3\xd2\x0b\xd0\x89\x95X\xff\xff\xff\x89\xbdT\xff\xff\xff\x8b\xcf\x8b\xc2\x0f\xac\xc1\x08\x0f\xa4\xfa\x08\xc1\xe8\x08\x89\x85h\xff\xff\xff\x8b\xc1\x8b\x8dh\xff\xff\xff3\xca\x8b\x95T\xff\xff\xff\xc1\xe7\x083\xc7\x8b\xbdX\xff\xff\xff\x0f\xa4\xd7\x08%\xff\x00\xff\x00\xc1\xe2\x083\xc2\x81\xe1\xff\x00\xff\x003\xcf\x8b\xd0\x89\x85T\xff\xff\xff\x8b\xf9\x0f\xac\xfa\x10\x89\x8dX\xff\xff\xff\x0f\xa4\xc1\x10\xc1\xe0\x103\xd0\x8b\x85T\xff\xff\xff FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00h\x84\xdb\x8b\xd7\x8b\xf1t\x0e\xc1\xe6\x1a\xc1\xe9\x02\xc1\xe2\x1a\xc1\xef\x02\xeb
\xc1\xe6\x1b\xd1\xe9\xc1\xe2\x1b\xd1\xef\x0b\xd7\x0b\xf1\x81\xe6\xff\xff\xff\x0f\x8b\xce\xd1\xe9\x8b\xf9\x81\xe7\x00\x00\x00\x07\x89M\x0c\x8b\xde\x81\xe3\x00\x00\xc0\x00\x0b\xfb\xd1\xef\x8b\xde\x81\xe3\x00\x00\x10\x00\x0b\xfb\xc1\xef\x14\x8b\xd9\x81\xe3\x00\x00\x06\x00\x8b\xce\x81\xe1\x00\xe0\x01\x00\x0b\xd9\x8b\x0c\xbd\xb8#\x00h\xc1\xeb
\x0b\x0c\x9d\xb8"\x00h\x8b}\x0c\x81\xe7\x00\x0f\x00\x00\x81\xe2\xff\xff\xff\x0f\x8b\xde\x81\xe3\xc0\x00\x00\x00\x0b\xfb\xc1\xef\x06\x0b\x0c\xbd\xb8!\x00h\x8b\xfe\x83\xe7?\x0b\x0c\xbd\xb8 \x00h\x8b\xfa\xd1\xef\x89}\xfc\x81\xe7\x00\x00\x00\x06\x8b\xda\x81\xe3\x00\x00\xe0\x01\x0b\xfb\x8b]\xfc\x81\xe3\x00\x1e\x00\x00\x89U\x08\x81\xe2\x80\x01\x00\x00\x0b\xda\xc1\xef\x15\x8b\x14\xbd\xb8'\x00h\xc1\xeb\x07\x0b\x14\x9d\xb8%\x00h\x8b}\x08\x8b\xdf\xc1\xeb\x0f\x83\xe3?\x0b\x14\x9d\xb8&\x00h\x83\xe7?\x0b\x14\xbd\xb8$\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xec\x8bE\x10\x8b\x08\xf6\xc1\x01u9\x83\xf9 r4\xd1\xe9\x89\x08\x8b\xc1\xc1\xe8\x05@\xf6\xc1\x1ft\x01@\x8d\x0c\x80\x8d\x14\xcd\x14\x00\x00\x00\x8bM\x0c\x89\x11\x8d\x14\xc5\x14\x00\x00\x00\x8bE\x08\x89\x10\xb8\x01\x00\x00\x00]\xc2\x0c\x003\xc0]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec\x90\x00\x00\x00S\x8b]\x08\x8b\x03W3\xff=RSA1\x89}\xfct
_3\xc0[\x8b\xe5]\xc2\x0c\x00\x8bC\x08\xd1\xe8V\x8b\xf0\xc1\xee\x05F\xa8\x1ft\x01F\x8bK\x10\xb8\x01\x00\x00\x00;\xc8\x8d\x0c6u\x11\x8bu\x0c\x8b}\x10\xf3\xa5^_[\x8b\xe5]\xc2\x0c\x00\x8dC\x14QP\x89E\xf8\x8bE\x0cP\x89M\x08\xe8#\x08\x00\x00\x85\xc0}b\xc1\xe6\x03\x81\xfe\x88\x00\x00\x00v\x14Vj\x00\xff\x15\x00\x11\x00h\x85\xc0\x89E\xfctG\x8b\xd0\xeb\x06\x8d\x95p\xff\xff\xff3\xc0\x8b\xce\xc1\xe9\x02\x8b\xfa\xf3\xab\x8b\xce\x83 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xd5\xf8\xff\xff\xff\x89M\x14\xeb\x06\x8bu\xf4\x8bE\x10\x8bM\xcc3\xd2\x8a4\x06\x8aT\x06\xff\x8b\xc2\xc1\xea\x08;\xcau
\xbe\xff\x00\x00\x00\x89u\x1c\xeb 3\xd2\xf7\xf1\x89E\x1c\x8b\xf0\x8b\xc6%\x00\x00\x00\x80\xf7\xd8\x1a\xc0\x8bM\xfc\x8b}\xf8\x89]\xd8\x8d\x0c\x8d\xfc\xff\xff\xff\x8b\xd1\x897%\xff\x00\x00\x00\x0f\xb6\xc0\x8a\xd8\x8bu\xfc\x8a\xfb\xc1\xe9\x02\x83\xc7\x04V\x8b\xc3\xc1\xe0\x10f\x8b\xc3\x8b]\xd8\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\xf8\x8bM\xf0PQS\xe8\xfd\xf6\xff\xff\x8b}\xec\x8d\x0c\xb5\x00\x00\x00\x00\x8b\xd1\xc1\xe9\x023\xc0\xf3\xab\x8b\xca\x83\xe1\x03\xf3\xaa\x8bE\x14\x8b}\xec\x8b\xc8\x83\xe1\x1f\xba\x01\x00\x00\x00\xd3\xe2V\xc1\xe8\x05S\x89\x14\x87\x8bE\xf8WP\xe8\xbf\xf6\xff\xff\x8bM\xf8\x8bU\xf4VQRS\xe8T\x04\x00\x00\x8bG\xfc\x85\xc0y)\x8bE\xf0\x8bM\xf8VPWQ\xe8\x9a\xf6\xff\xff\x8bU\xf8VRSS\xe8\xee\x03\x00\x00\x8bM FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00+\xc1\x83\xd2\x00\x89D\xaf\x0c\x8b\xca\x83\xc5\x04u\x96]\x8b\xc1_^[]\xc2\x10\x00\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecSVW\x8bu\x0c\x8b}\x08\x8bM\x103\xdb\x8b\x06\x83\xc6\x04\xf7\xe0\x03\xd8\x8b\x07\x83\xd2\x00\x03\xc3\x8b_\x04\x83\xd2\x00\x89\x07\x03\xd3\xbb\x00\x00\x00\x00\x89W\x04\x83\xd3\x00\x83\xc7\x08Iu\xd5_^[]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xccj\x08hx`\x00h\xe8\x9e1\xff\xff\x83e\xfc\x00\xffu\x08\xff\x15\xb4\x11\x00h\x83M\xfc\xff3\xc0\xeb\x1e\x8bE\xec\x8b\x00\x8b\x003\xc9=\x17\x00\x00\xc0\x0f\x94\xc1\x8b\xc1\xc3\x8be\xe8\x83M\xfc\xffj\x08X\xe8\xa11\xff\xff\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec]\xff%\xb8\x11\x00h\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec@VWj\x0eY3\xc0\x8d}\xc0\xf3\xab\x8dE\xfcPj\x013\xf6!u\xfc!u\xf8j\x08\xff\x15\x08\x11\x00hP\xff\x15 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xff\xff\xff\xd6\x85\xc0t%\x8d\x85\xe4\xfb\xff\xffPSSSSSSSj\x123\xf6FV\x8d\x85\xf4\xfb\xff\xffP\xff\x15D\x10\x00h\x85\xc0u
\xff\x15\xc8\x11\x00h\x8b\xf8\xeb\x1c\x8b\x85\xdc\xfb\xff\xff\xff0\xff\xb5\xe4\xfb\xff\xff\xff\x15P\x10\x00h\x85\xc0t\x02\x8973\xff9\x9d\xe0\xfb\xff\xfft\x0b\xff\xb5\xe0\xfb\xff\xff\xe8I\xf1\xff\xff9\x9d\xe4\xfb\xff\xfft\x0c\xff\xb5\xe4\xfb\xff\xff\xff\x15$\x10\x00h9\x9d\xe8\xfb\xff\xff\x8b5\x04\x11\x00ht\x08\xff\xb5\xe8\xfb\xff\xff\xff\xd69\x9d\xf0\xfb\xff\xfft\x08\xff\xb5\xf0\xfb\xff\xff\xff\xd6\x8bM\xfc\x8b\xc7_^[\xe8\xb8\x1e\xff\xff\xc9\xc2\x04\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x81\xec \x04\x00\x00\xa1\x84\x18\x03hS\x89E\xfcV3\xdb\x8d\x85\xfc\xfb\xff\xffW\x8b}\x08\x89\x85\xe0\xfb\xff\xff\x8d\x85\xf0\xfb\xff\xffPj\x08\x89\x9d\xf0\xfb\xff\xff\xc7\x85\xec\xfb\xff\xff\x00\x04\x00\x00\x89\x9d\xe4\xfb\xff\xff\x89\x9d\xe8\xfb FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00\x00\x8d\x85T\xff\xff\xffP\xe9Q\xff\xff\xff\x89\x8dP\xff\xff\xff\xe9\x82\x02\x00\x00W\xff\xb5H\xff\xff\xff\xff\x15,\x11\x00h\x83\xf8\xff\x0f\x84\xfb\xfe\xff\xff\x83\xf8\x1c\x0f\x82c\x02\x00\x00WWWj\x02W\xff\xb5H\xff\xff\xff\xff\x15<\x11\x00h;\xc7\x89\x85<\xff\xff\xff\x0f\x84\xd2\xfe\xff\xffWWWj\x04P\xff\x158\x11\x00h;\xc7\x89\x85L\xff\xff\xff\x0f\x84\xb8\xfe\xff\xff\x8b\x00\x83\xf8\x02\x89\x03\x0f\x85\x1c\x02\x00\x00\x83{ \x00\x8b\x85L\xff\xff\xff\x8dS\x04j\x07\x8dp\x04Y\x8b\xfa\xf3\xa5t\x14\x83:\x00t\x0f\xc7\x85P\xff\xff\xff"\x00 \x80\xe9\xef\x01\x00\x00\x8bH \x8b@$\xffs\x08\x89\x8d4\xff\xff\xff\x89\x858\xff\xff\xff\xe8\xa6\xe0\xff\xff\x85\xc0\x89C@\x0f\x84q\x01\x00\x00\x8bK\x08\x8b\xb5L\xff\xff\xff\x8b\xf8\x8b\xc1\xc1\xe9\x02\x83\xc6(\xf3\xa5\x8b\xc8\x83\xe1\x03\xf3\xa4\x8bs\x08\xffs\x1c\x83\xc6(\x89\xb5P\xff\xff\xff\xe8k\xe0\xff FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x83\xf8\x05\x0f\x85h\x01\x00\x00C\xeb\xc3\xff\xb5\xa8\xfd\xff\xff\xff\x15\xc0\x11\x00h\x83\x8d\xa8\xfd\xff\xff\xff\x83\xa6\x04\x01\x00\x00\x00\x89\x9e\x08\x01\x00\x00i\xdb\x05\x01\x00\x00S\xc7\x86\x00\x01\x00\x00\x05\x01\x00\x00\xe8*\xd1\xff\xff\x85\xc0\x89\x86\x0c\x01\x00\x00u\x08j\x08[\xe9\x1f\x01\x00\x003\xc0PP\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xffP\xf3\xab\x8d\x8d\xac\xfd\xff\xffQP\xff\xb5\x98\xfd\xff\xff\xff\x15$\x11\x00h\x83\xf8\xff\x89\x85\xa8\xfd\xff\xff\x0f\x84\x00\xff\xff\xff\x8b\x1dD\x11\x00h\x8d\x8d\xac\xfd\xff\xffQP\xff\xd3\x85\xc0t"3\xc0\xb9\x94\x00\x00\x00\x8d\xbd\xac\xfd\xff\xff\xf3\xab\x8d\x85\xac\xfd\xff\xffP\xff\xb5\xa8\xfd\xff\xff\xff\xd3\x85\xc0u\x0e\xff\x15\xc8\x11\x00h\x83\xf8\x12\xe9\xc5\xfe\xff\xff\x83\xa5\x9c\xfd\xff\xff\x00\x83\xbe\x08\x01\x00\x00\x00\x8b\xbe\x0c\x01\x00\x00\x0f\x86\x86\x00\x00\x00\x8d\x85\xa0\xfd\xff\xffPW\xff\xb5\xa4\xfd\xff\xff\x8d\x85\xd8\xfd\xff\xffPj\x01\xc7\x85 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => W\xe8\x13\xfc\xff\xff\x85\xc0u:\x8dE\xfcP\x8dE\xf8PVh\xe4\x1a\x03hha\x1d\x00\x00W\xe8\xf6\xfb\xff\xff\x85\xc0u\x1d\x8dE\xfcP\x8dE\xf8PVh\x04\x1b\x03hhb\x1d\x00\x00W\xe8\xd9\xfb\xff\xff\x85\xc0t*\x8b\xf0\xa1\xa8\x1a\x03h\x85\xc0t
P\xe8Z\xc1\xff\xff\x83%\xa8\x1a\x03h\x00\x85\xfft\x07W\xff\x15\xa4\x11\x00h\x8b\xc6\xe9\x92\x00\x00\x00\xa1\xa8\x1a\x03h\x01\x05\xbc\x1a\x03h\x01\x05\xc0\x1a\x03h\x01\x05\xc4\x1a\x03h\x01\x05\xb0\x1a\x03h\x01\x05\xb4\x1a\x03h\x01\x05\xb8\x1a\x03h\x01\x05\xd4\x1a\x03h\x01\x05\xd8\x1a\x03h\x01\x05\xc8\x1a\x03h\x01\x05\xcc\x1a\x03h\x01\x05\xd0\x1a\x03h\x01\x05\xe0\x1a\x03h\x01\x05\xf4\x1a\x03h\x01\x05\xfc\x1a\x03h\x01\x05\xf8\x1a\x03h\x01\x05\x00\x1b\x03h\x01\x05\xdc\x1a\x03h\x01\x05\xf0\x1a\x03h\x01\x05\xec\x1a\x03h\x01\x05\xe8\x1a\x03h\x01\x05\xe4\x1a\x03h\x01\x05\x04\x1b\x03hW\xff\x15\xa4\x11\x00h3\xc0 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x11\x00h3\xff\xe9\x88\x00\x00\x003\xc0\x8dM\xfc@QPS\x89E\xf4\xff\xd6P\xff\xd7\x85\xc0t]3\xc0\x8d}\xd8\xab\xab\xab\xab3\xc0\x8d}\xc8\xab\xab\xab\xab\x8dE\xe8Ph c\x00hj\x00\xff\x15p\x10\x00h\x85\xc0t6\x8bE\xe8\x89E\xdc\x8bE\xec\x89E\xe0\x8dE\xf0P\x8dE\xc8Pj\x10\x8dE\xd8Pj\x00\xffu\xfc\xc7E\xd8\x01\x00\x00\x00\xc7E\xe4\x02\x00\x00\x00\xff\x15\x80\x10\x00h\x89E\xf83\xff\xffu\x1c\xffu\x18\xffu\x14\xffu\x10\xffu\x0c\xe8\xc3\xe6\xff\xff9}\x08\x8b\xf0t\x179}\xf8t\x12WWj\x10\x8dE\xc8PW\xffu\xfc\xff\x15\x80\x10\x00h9}\xfct \xffu\xfc\xff\x15\x04\x11\x00h9}\xf4t\x06\xff\x15X\x10\x00h_\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQV\x8b5\x08\x1b\x03hWV\x89u\xfc\xe8\x88\xaf\xff\xff\x8b\xf8\x85\xff\x0f\x85\x02\x01\x00\x009F \x0f\x84\xf1\x00\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xc0\x0f\x84\xd2\xfc\xff\xff3\xf6F\x83}\xb4\x00\x0f\x85\xfd\x01\x00\x00\x8bM\xb0\x8dA\x019E\xd4\x0f\x84\xee\x01\x00\x009M\xd4\xffu\x10\x0f\x85\xd8\x01\x00\x00\x8dE\xb8P\xffu\xe4\xffu\x0c\xffu\x08\xe8]-\x00\x00\x8b\xf0\x85\xf6\x0f\x84\xe3\x01\x00\x00\x83}\xb8\x01uj\xffu\x10\x8dE\xbcP\x8bE\xcc\xff0\xffu\x0c\xffu\x08\xffu\xc8\xffs \xe8\x07\xf9\xff\xff\x8b\xf0\x85\xf6\x0f\x84\xb6\x01\x00\x00\x83}\xbc\x00u=\xffu\x10\xffu\x0c\xffwT\xffu\x08\xe8G+\x00\x00\x85\xc0\x0f\x84B\xfc\xff\xff\xffu\x10\x8dE\xacPj\x01j\x08\xffwT\xffu\x0c\xffu\x08\xe8&7\x00\x00\x85\xc0\x0f\x84!\xfc\xff\xff3\xf6F\x83}\xac\x00\x0f\x84\xe8\xfe\xff\xff\xffE\xfc\x83E\xd0\x04\x83E\xdc\x08\x83E\xcc\x04\x83}\xfc\x01\x0f\x86\x18\xfc\xff\xff\x83e\xfc\x00\x8dG<\x89E\x08\x8dC0\x89E\xcc\x8dC8\x89E\xd0\xffu\x10\x8bE\x08\xffu\xd0j\x01\xff FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xd0\x8b\xd9\x83\xe0\x1f\xc1\xea\x05\xc1\xee\x05;\xc3\x89]\xfcr\x1b\x8dK\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xc8\x8bE\x08\x8b\x14\x90+\xcb\xd3\xea\xeb\x19\x8dH\x01;\xf9\x89M\x18w\x03\x89}\x18\x8b\xcb+\xc8\x8bE\x08\x8b\x14\x90\xd3\xe2j Y+M\x18\x83\xc8\xff\xd3\xe0j\x1fY+M\xfc\xd3\xe8\x8bM\x10\x8d\x0c\xb1\x8b\xf0\xf7\xd6#1#\xc2\x0b\xf0+}\x18\x891\x0f\x85w\xff\xff\xff^[3\xc0@_\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecVW\xffu\x0c\x8b}\x08W\xe8\xbe\xfd\xff\xff\x8b\xf0\x85\xf6t\x0f\xfft\xb7\xfc\xe8Z\xfe\xff\xffN\xc1\xe6\x05\x03\xc6_^]\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecV3\xc93\xf69M\x0ct\x0e\x8bE\x089\x0c\xb0u\x18F;u\x0cu\xf5\xffu\x10Qj\x11\xe8\\xb7\xfe\xff3\xc0^]\xc2\x0c\x00\xff4\xb0\xe8M\xfe\xff\xff\xc1\xe6\x05\x03\xc6\xeb\xec\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xecQ FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xfc\x839\x00u\x08N\x83\xe9\x04\x85\xf6u\xf3\x8dD\x18\xfc\x838\x00u\x08J\x83\xe8\x04\x85\xd2u\xf3\xffu0\x8b]\xe4\x8dE\x80P\xffu,\x89u\xe8\x8bu\xe0SV\x8dE\x90P\x89U\xec\xe8\x89'\x00\x00\x85\xc0\x0f\x84 \x01\x00\x00\x8bM\x803\xffG\x85\xc9u 9M\x84\x0f\x84\x00\xfc\xff\xff\x8bE,;E\x14\x0f\x83\xf1\x00\x00\x00\x89\x0c\x86\x8bE,\x8bM\x84\x89\x0c\x83\xe94\xfe\xff\xff\x8b}\xf4\x8bU\xb4\xc1\xe7\x02\xc1\xe2\x02\x8bD\x15\xe8\x8bL\x15\xe0\x8dt=\xe8\x8b\x1e+\xd8\x89E\xfc\x8bE,C\x89M\xb4\xe8\xcb\xf6\xff\xff\xffu0\x89E\xf8\xffu\xd4\x8bD=\xd8\xffu\xd0j\x00\xffu\xfc\xfft\x15\xd8\xff6P\xe8\xa1\x11\x00\x00\x85\xc0\x0f\x84\x85\x00\x00\x00\x8bM\xd0\x8b\xc3\xe8\x98\xf6\xff\xff\x8bM\xd4\x8b\xd8\x8bE\xfc\xe8\x8b\xf6\xff\xff\x89\x06\xc1\xe0\x02P\xffu\xd4\xfft=\xd8\xe8\xe1<\x00\x00\x83\xc4\x0c\xffu0\xffu\xd4\xffu FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x01\x00\x00\x8dt\x9e\xfc\x8b\x06;\xc1\x89u\xe8\x0f\x84\xff\x00\x00\x00P\x89M\xfc\x89M\xec\xe8\xe0\xde\xff\xff\x8b>j Y+\xc8\x83\xfb\x02\x89M\xf8r \x8bE\x08\x8bt\x98\xf8\xeb\x023\xf6\x83\xfb\x03r \x8bE\x08\x8bT\x98\xf4\xeb\x023\xd2j\x1f[\xffu\x14+\xd9\x83e\xf4\x00\x8b\xc6\xd1\xe8\x8b\xcb\xd3\xe8\x8bM\xf8\xd3\xe7\xd1\xea\x8b\xcb\xd3\xea\x8bM\xf8\xd3\xe6\x0b\xc7\x8d}\xecW\x0b\xd6\x8b\xf2\x83\xcb\xff\x8d}\xfcW\x8b\xd3P+\xd0\x8b\xcb+\xceRQ\xe8\xa8\xfe\xff\xff\x85\xc0t9\x8bE\xfc\xf7\xe6;U\xec\xc7E\xf4\x01\x00\x00\x00\x89E\xe0v\x03\xffM\xfc\x8bM\xf8\x8bE\xe8\x8b}\x0c\x8b\xf3\xd3\xee+0O;u\xfcsD\x85\xffv\x0f\x8bE\x08\x8bD\xb8\xfc\xeb\x08\x83e\xf4\x00\xebW3\xc0\x8bU\x08\x83e\xe4\x00\x8b\xcb+\xc8\x8bE\xfc\xf7$\xba;\xd6w\x17r\x04;\xc1w\x11+\xc8\x1b\xf2\x89u\xe4\x8b\xf1u \x85\xffu\xbb\xeb\x03 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xfb\xcb\x0f\xd4\xc1\x0f\x7f\xc1\x0f\x7f\xd3\x0f\xdb\xcb\x0f\x7f \x83\xc1\x10O\x0fs\xd0 \x0f\x7f\xc1u\xd19S\x0c\x0f\xef\xc0\x0f\x7f\xc3\x0f\xfb\xd9\x0f\x7f\xd9\x0f\xdf\xcat.\x8bK\x08+\xf1\x0fo\x14\x0e\x0f\xd4\xc2\x0fo\x11\x0f\x7f\xcb\x0f\xdb\xd3\x0f\xd4\xc2\x0f\x7f\xc2\x0f~\xd7\x89<\x90B\x83\xc1\x10;S\x0c\x0fs\xd0 u\xd7\x0fw3\xc0_@^\x8b\xe5]\x8b\xe3[\xc2\x0c\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffS\x8b\xdcQQ\x83\xe4\xf0\x83\xc4\x04U\x8bk\x04\x89l$\x04\x8b\xec\x83\xec8\x8bC\x10\x8bK\x18\x83e\xec\x00\x83M\xe8\xff\x83e\xe4\x00\x83M\xe0\xfff\x0foU\xe0\x89E\xd0\x8bC\x14V\x8b0W\x8bx \x8b@\x1c\x89E\xdc\x8bC\x08\x8b\x10\x0f\xafU\xdc\x83\xc1\x0f\x8b\xc6\x83\xe1\xf0\xc1\xe0\x04\x03\xc1\x85\xf6\x89U\xc8\x89E\xd4tY\x8bS\x08+\xd7\x89E\xf8)M\xf8f\x0f\xef\xc0\x89M\xd8\x89}\xfc\x89U\xcc\x89u\xf4\xeb\x03\x8bU\xcc\x8b}\xfc FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \xff\x85\xf6t\x08\x8b\xc8\x8b\xc2\x8b\xd1\x8b\xce\x83e\x14\x00\x85\xd2_u\x0f\x8bU\x18\x8bu\xfc\x89\x02\x89J\x04\xebh\xd1\xea\x8b\xda\xf7\xd3\xf6\xc3\x01u\xf5\xeb1;\xc2\x1b\xf6\xf7\xde+\xce+\xc2\xeb
\x8b\xf1\xc1\xe6\x1e\xc1\xe8\x02\x0b\xc6\xc1\xe9\x02\xa8\x03t\xef\x8b\xd8\xf7\xd3\xf6\xc3\x01t\x0b\x8b\xf1\xc1\xe6\x1f\xd1\xe8\x0b\xc6\xd1\xe9\x85\xc9u\xcb\xffu\x1c\x8dM\x14QRP\xe8
\xfe\xff\xff3\xf6\x85\xc0t\x12\x8bE\x14\x83e\x14\x00\x8bM\x18F3\xd2\x89\x01\x89Q\x04\x8b\xc6^[\xc9\xc2\x18\x00\xcc\xcc\xcc\xcc\xcc\x8b\xffU\x8b\xec\x83\xec\x10SVW\xffu\x1c\xffu\x10\xffu\x0c\xe8\xd3\xbf\xff\xff\x8bu\x18\x8b\x1e\xffu\x1c\x8bN\x08\x89E\xf8\x8b\xc3\xc1\xe0\x02j\x00\x03\xc8Q\x89E\xf0\xe8 \xc6\xff\xff\x8b\xf8\x85\xff\x89}\xfcu\x073\xdb\xe9\xbc\x01\x00\x00\x83}\xf8\x00\xffu\x1c\xff6u\x1d\xffv \x8bF,\xffu\x14PP\xe8\xf8\xb3\xff\xff\x8b\xd8\xf7\xdb FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => Data\x002\x00\x00CryptUnprotectData\x00d\x00\x00SHGetFolderPathW\x002\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\xc0\xe0\x02\x00\xe0\x11\x00\x00\x10\xdf\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00N\xe3\x02\x00\xd4\x10\x00\x00<\xde\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00j\xe4\x02\x00\x00\x10\x00\x00T\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xe7\x02\x00\x18\x12\x00\x00\x0c\xe0\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00D\xe7\x02\x00\xd0\x11\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\xea\x02\x00\x00\xea\x02\x00\xe0\xe9\x02\x00\xc2\xe9\x02\x00\xa6\xe9\x02\x00\x8a\xe9\x02\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00FL\x01h\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00J\xdd\xa2,y\xe8!\x05\xd4\x13\x00h\xc0\x13\x00h\xbc\x13\x00h\xa8\x13\x00h\x94\x13\x00h\xbc\x13\x00h\x80\x13\x00hl\x13\x00h\xbc\x13\x00hX\x13\x00hH\x13\x00h FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => m (SHA-1)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 2 (MD2)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Digest 4 (MD4)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x80\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00\x80\x00\x00\x00 \x00\x00\x00\x04\x00\x00\x00MD5\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x17\x00\x00\x00Message Dige FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00RSA Data Security's RC4\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01f\x00\x008\x00\x00\x008\x00\x00\x008\x00\x00\x00\x0f\x00\x00\x00\x04\x00\x00\x00DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1f\x00\x00\x00Data Encryption Standard (DES)\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 f\x00\x00p\x00\x00\x00p\x00\x00\x00p\x00\x00\x00\x0f\x00\x00\x00
\x00\x00\x003DES TWO KEY\x00\x00\x00\x00\x00\x00\x00\x00\x13\x00\x00\x00Two Key Triple DES\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03f\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\xa8\x00\x00\x00\x0f\x00\x00\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000264 FileInformation => \xd0\x10\x03\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtSetInformationFile |
FileHandle => 0x00000264 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x00\x01\x00\x00P\x01\x00\x00\x1c\x86V\xe4\x80\xb9\x0fs\x00\x007\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00o\x00p\x00e\x00n\x00 \x00s\x00i\x00g\x00n\x00a\x00t\x00u\x00r\x00e\x00 \x00f\x00i\x00l\x00e\x00?\x00C\x00A\x00P\x00I\x00:\x00 \x00T\x00h\x00e\x00 \x00i\x00n\x00s\x00t\x00a\x00l\x00l\x00 \x00p\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00c\x00o\x00u\x00l\x00d\x00 \x00n\x00o\x00t\x00 \x00g\x00e\x00t\x00 \x00t\x00h\x00e\x00 \x00s\x00i\x00z\x00e\x00 \x00o\x00f\x00 \x00R\x00s\x00a\x00b\x00a\x00s\x00e\x00.\x00s\x00i\x00 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,653 | 1676 | NtReadFile |
Buffer => \x07:\x0e:\x18:%:t:\x81:\x8f:\x9f:\xad:\xbb:\xc9:\xda:\xe8:\xf6:\x04;\x12; ;2;C;Q;\xa0;\xdb;\xe5;\xef;\xf9;\x10<\x17<'<4<M<T<a<l<~<\x85<\x8f<\x99<\xda<\xe7<\xf7<\x01=\x18=\x1f=/=:=Q=X=h=s=\x85=\x8c=\x96=\xa3=\xde=\xeb=\xfb=\x05>\x1c>#>3>>>R>Y>i>t>\x86>\x8d>\x97>\xa4>\xdf>\xe9>\xf9>\x03?\x17?$?4???S?Z?j?u?\x87?\x8e?\x98?\xa3?\xdc?\xe6?\xf6?\x00\x80\x01\x00\xe4\x01\x00\x00\x000\x170\x1e0.090L0W0g0r0\x840\x8b0\x950\xa20\xee0\xfa0\x081\x1e1(181F1W1d1t1\x821\x901\xa21\xaf1\xbd1\xcb102k2u2\x7f2\x892\xa02\xa72 FileHandle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrLoadDll |
Flags => 33291232 BaseAddress => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | RegOpenKeyExA |
Handle => 0x00000264 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | RegQueryValueExA |
Handle => 0x00000264 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | RegQueryValueExA |
Handle => 0x00000264 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | RegCloseKey |
Handle => 0x00000264 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrLoadDll |
Flags => 33291008 BaseAddress => 0x77fe0000 FileName => Secur32.dll |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExA FunctionAddress => 0x77fe1dca ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:18,693 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:18,693 | 1676 | RegCloseKey |
Handle => 0x00000260 |
SUCCESS | 0x00000000 | |
| 09:15:18,723 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:18,723 | 1676 | LdrLoadDll |
Flags => 33291280 BaseAddress => 0x77a80000 FileName => CRYPT32.dll |
SUCCESS | 0x00000000 | |
| 09:15:18,723 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptProtectData FunctionAddress => 0x77a8b942 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:18,773 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,773 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,773 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,773 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,773 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,773 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,773 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,813 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,813 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,813 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,843 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,843 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,843 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,853 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,863 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,863 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,863 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000274 FileInformation => 0\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00=L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,863 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,873 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdr.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,883 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,883 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000274 FileInformation => \x90"iR\x8a\xa2\xcf\x01\x90"iR\x8a\xa2\xcf\x01\x90"iR\x8a\xa2\xcf\x01\x90"iR\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00>L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb2\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,883 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,883 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,893 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,893 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:18,893 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002385a0 | |
| 09:15:18,923 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdri.dat DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000274 FileInformation => \xc0\xa9jR\x8a\xa2\xcf\x01\xc0\xa9jR\x8a\xa2\xcf\x01\xc0\xa9jR\x8a\xa2\xcf\x01\xc0\xa9jR\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00?L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:18,923 | 1676 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000274 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000274 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:18,923 | 1676 | RegOpenKeyExA |
Handle => 0x00000274 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000274 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000274 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegCloseKey |
Handle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegOpenKeyExA |
Handle => 0x00000274 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000274 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000274 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000274 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegOpenKeyExA |
Handle => 0x00000270 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000270 DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegQueryValueExA |
Handle => 0x00000270 Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegCloseKey |
Handle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:18,923 | 1676 | RegCloseKey |
Handle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:18,923 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x002439a0 | |
| 09:15:18,933 | 1676 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security\services_rdrk.dat DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000270 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000274 FileInformation => 0\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x010\x14fR\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00\xb4\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00=L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:18,933 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUnprotectData FunctionAddress => 0x77a8baf0 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:18,933 | 1676 | NtDeviceIoControlFile |
InputBuffer => 62D8AECFF07893A784AFE2B57DEAD2D6\x00\x07\x07\x07\x07\x07\x07\x07 FileHandle => 0x00000090 OutputBuffer => 62D8AECFF07893A784AFE2B57DEAD2D6\x00\x07\x07\x07\x07\x07\x07\x07 |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,133 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,143 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,143 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,143 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,183 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,183 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,183 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,183 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,193 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,193 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,193 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,193 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,193 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,193 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,193 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,193 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,193 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,193 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,334 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,334 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,334 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:19,334 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:19,344 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:19,344 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,344 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,344 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,344 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,344 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,344 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,344 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,344 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,344 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,344 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,354 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,354 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,354 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,354 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,364 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,364 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,364 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,364 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:19,364 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:19,364 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:19,364 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:19,364 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,364 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,364 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002439a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002439a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002439a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002439a0 | |
| 09:15:19,374 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,374 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,374 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x002385a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x002385a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x002385a0 | |
| 09:15:19,374 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x002385a0 | |
| 09:15:19,374 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,374 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000274 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:19,374 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000270 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:19,474 | 1676 | RegOpenKeyExW |
Handle => 0x00000270 Registry => 0x80000002 SubKey => Software\Adobe\Acrobat Reader\11.0\Installer |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegQueryValueExW |
Handle => 0x00000270 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegCloseKey |
Handle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrGetProcedureAddress |
Ordinal => 43 FunctionName => FunctionAddress => 0x7ca23a9d ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ShellExecuteExW FunctionAddress => 0x7ca02f03 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInitializeEx FunctionAddress => 0x774fef7b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegOpenKeyExA |
Handle => 0x00000270 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegQueryValueExW |
Handle => 0x00000270 DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:15:19,474 | 1676 | RegOpenKeyExA |
Handle => 0x00000274 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegQueryValueExW |
Handle => 0x00000274 DataLength => 520 ValueName => MaximizeApps Type => 33290608 |
FAILURE | 0x00000002 | |
| 09:15:19,474 | 1676 | RegCloseKey |
Handle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | RegCloseKey |
Handle => 0x00000270 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrLoadDll |
Flags => 33290920 BaseAddress => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetGetJoinInformation FunctionAddress => 0x5b869b54 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:19,474 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\wkssvc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | NtSetInformationFile |
FileHandle => 0x00000274 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,484 | 1676 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\x98\xd0\xffk\x12\xa1\x106\x983F\xc3\xf8~4Z\x01\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000274 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | NtReadFile |
Buffer => FileHandle => 0x00000274 |
SUCCESS | 0x00000103 | |
| 09:15:19,484 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x5b860000 FileName => netapi32 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegOpenKeyExW |
Handle => 0x00000276 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegEnumKeyW |
Handle => 0x00000276 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 0 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegOpenKeyExW |
Handle => 0x00000272 Registry => 0x80000000 SubKey => Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegQueryValueExW |
Handle => 0x00000272 Data => 32 ValueName => DriveMask |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegCloseKey |
Handle => 0x00000272 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | RegEnumKeyW |
Handle => 0x00000276 Name => {fbeb8a05-beee-4442-804e-409d6c4515e9} Index => 1 |
FAILURE | 0x00000103 | |
| 09:15:19,484 | 1676 | RegCloseKey |
Handle => 0x00000276 |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | LdrLoadDll |
Flags => 33288956 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,484 | 1676 | LdrGetProcedureAddress |
Ordinal => 102 FunctionName => FunctionAddress => 0x7c9ef5e2 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | LdrLoadDll |
Flags => 33288996 BaseAddress => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | LdrGetProcedureAddress |
Ordinal => 320 FunctionName => FunctionAddress => 0x773e0a75 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | LdrGetProcedureAddress |
Ordinal => 324 FunctionName => FunctionAddress => 0x773e0c22 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | LdrGetProcedureAddress |
Ordinal => 323 FunctionName => FunctionAddress => 0x773e0b17 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | RegOpenKeyExW |
Handle => 0x00000274 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | RegOpenKeyExW |
Handle => 0x00000270 Registry => 0x00000274 SubKey => FileExts |
SUCCESS | 0x00000000 | |
| 09:15:19,494 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000270 SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:19,494 | 1676 | LdrGetProcedureAddress |
Ordinal => 326 FunctionName => FunctionAddress => 0x773e0cc1 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027a Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027a Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027e Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000027e SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000282 Registry => 0x0000027e SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027e |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => DontShowSuperHidden Type => 33288660 |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x00000274 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 36 ValueName => ShellState Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => ValueName => ShellState |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => ForceActiveDesktopOn Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => NoActiveDesktop Type => 33287988 |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\System |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | GetSystemMetrics |
SystemMetricIndex => 4096 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => NoWebView Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => ClassicShell Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,504 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,504 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => SeparateProcess Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => NoNetCrawling Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => NoSimpleStartMenu Type => 33287992 |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x0000027c Registry => 0x00000274 SubKey => Advanced |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 2 ValueName => Hidden |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 1 ValueName => ShowCompColor |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 1 ValueName => HideFileExt |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 0 ValueName => DontPrettyPath |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 1 ValueName => ShowInfoTip |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 0 ValueName => HideIcons |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 0 ValueName => MapNetDrvBtn |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 1 ValueName => WebView |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 0 ValueName => Filter |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => ShowSuperHidden Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c Data => 0 ValueName => SeparateProcess |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegQueryValueExW |
Handle => 0x0000027c DataLength => 4 ValueName => NoNetCrawling Type => 33289160 |
FAILURE | 0x00000002 | |
| 09:15:19,514 | 1676 | RegCloseKey |
Handle => 0x0000027c |
SUCCESS | 0x00000000 | |
| 09:15:19,514 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000282 SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\.exe |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => SystemFileAssociations\application |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegQueryValueExW |
Handle => 0x00000282 DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegQueryValueExW |
Handle => 0x00000282 DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000282 SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegOpenKeyExW |
Handle => 0x00000286 Registry => 0x80000000 SubKey => * |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000286 SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegQueryValueExW |
Handle => 0x00000282 DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegQueryValueExW |
Handle => 0x00000282 DataLength => 0 ValueName => AlwaysShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | RegQueryValueExW |
Handle => 0x00000282 DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,524 | 1676 | LdrGetProcedureAddress |
Ordinal => 388 FunctionName => FunctionAddress => 0x773e1535 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | RegCloseKey |
Handle => 0x0000027a |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | RegCloseKey |
Handle => 0x00000282 |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | RegCloseKey |
Handle => 0x00000286 |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,524 | 1676 | LdrGetProcedureAddress |
Ordinal => 328 FunctionName => FunctionAddress => 0x773e1559 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,534 | 1676 | LdrLoadDll |
Flags => 33289120 BaseAddress => 0x77920000 FileName => SETUPAPI.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,534 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_Size_ExW FunctionAddress => 0x77929025 ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:15:19,534 | 1676 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeLoadDriverPrivilege |
SUCCESS | 0x00000001 | |
| 09:15:19,534 | 1676 | LookupPrivilegeValueW |
SystemName => PrivilegeName => SeUndockPrivilege |
SUCCESS | 0x00000001 | |
| 09:15:19,534 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CM_Get_Device_Interface_List_ExW FunctionAddress => 0x7792a15c ModuleHandle => 0x77920000 |
SUCCESS | 0x00000000 | |
| 09:15:19,534 | 1676 | NtOpenFile |
ShareAccess => 3 FileName => IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,544 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x1c\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:15:19,544 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01D\xf0\xfb\x01\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xa8\xcf$\x00`\xcb\x1f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x1c\x00 |
FAILURE | 3221225508 | |
| 09:15:19,544 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,544 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \xea\x01\x00\x00\x02\x00\x00\x00n\x01\x00\x00`\x00\x00\x008\x00\x00\x00\x1a\x01\x00\x00R\x01\x00\x00\x1c\x00v\x00\xce\x01\x00\x00\x1c\x00\\x008\x00\x00\x00\x1a\x01o\x00R\x01\x00\x00\x1c\x00\x00\x00\\x00?\x00?\x00\\x00I\x00D\x00E\x00#\x00C\x00d\x00R\x00o\x00m\x00V\x00B\x00O\x00X\x00_\x00C\x00D\x00-\x00R\x00O\x00M\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x00_\x001\x00.\x000\x00_\x00_\x00_\x00_\x00_\x00#\x004\x002\x005\x006\x002\x00d\x003\x002\x003\x001\x003\x000\x003\x000\x003\x007\x003\x003\x003\x000\x003\x006\x003\x007\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x002\x000\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x1c\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00C\x00d\x00R\x00o\x00m\x000\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,544 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x0000029c SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,544 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x000002a0 SubKey => {e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | LdrGetProcedureAddress |
Ordinal => 334 FunctionName => FunctionAddress => 0x773e0f5a ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | NtOpenFile |
ShareAccess => 3 FileName => STORAGE#Volume#1&30a96598&0&SignatureC7EDC7EDOffset7E00Length27F4DB200#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} DesiredAccess => 0x00100080 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,554 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => .\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 IoControlCode => 5046280 InBuffer => |
SUCCESS | 0x00000001 | |
| 09:15:19,554 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \x00\x00\x00\x00\x84\xf1\xfb\x01x \x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\xdc\xf1\xfb\x01\xe4\xf3\xfb\x01\xe4\xf3\xfb\x01S\x00o\x00\x18\x00\x00\x00\x00\x00\x00\x00h\xef\xfb\x01@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xd0\xcf$\x00\xc0\x1c \x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00 |
FAILURE | 3221225508 | |
| 09:15:19,554 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,554 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \xee\x00\x00\x00\x02\x00\x00\x00r\x00\x00\x00`\x00\x00\x008\x00\x00\x00\x0c\x00\x00\x00D\x00\x00\x00.\x00v\x00\xd2\x00\x00\x00\x1c\x00\\x008\x00\x00\x00\x0c\x00d\x00D\x00\x00\x00.\x00k\x00\xed\xc7\xed\xc7\x00~\x00\x00\x00\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\\x00D\x00o\x00s\x00D\x00e\x00v\x00i\x00c\x00e\x00s\x00\\x00C\x00:\x00 IoControlCode => 7143432 InBuffer => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00.\x00\x00\x00\\x00D\x00e\x00v\x00i\x00c\x00e\x00\\x00H\x00a\x00r\x00d\x00d\x00i\x00s\x00k\x00V\x00o\x00l\x00u\x00m\x00e\x001\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,554 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x0000029c SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => ValueName => Data |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x000002a0 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,554 | 1676 | LdrGetProcedureAddress |
Ordinal => 332 FunctionName => FunctionAddress => 0x773e0df4 ModuleHandle => 0x773d0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => |
FAILURE | 3221225508 | |
| 09:15:19,564 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,564 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,564 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\xd8r\x1e\x00\xfc\x0c\x82|x\x86#\x00b\x00d\x00\xd0\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|\xd0\x9b\x18\x00x\x86#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\xf1W\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\xf1W\x00\x00\xf1W\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\xf1W\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xb8:$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:19,564 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,564 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00C\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x002\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,564 | 1676 | RegCreateKeyExW |
Handle => 0x0000029c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | RegSetValueExW |
Handle => 0x0000029c Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,564 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => @\x00\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x08r\x1e\x00\xfc\x0c\x82|x\x86#\x00b\x00d\x00`\x9b\x18\x00x\x86#\x00h\xfc\xfb\x01\xc0\xf4\xfb\x01\xde \xa0|`\x9b\x18\x00\x00\x00\x00\x00\x00\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\xf1W\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\xf1W\x00\x00\xf1W\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\xf1W\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xb8:$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:19,564 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,574 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,574 | 1676 | NtQueryInformationFile |
FileHandle => 0xffffffff FileInformation => \xbb\x01\x91|\x84\xf4\xfb\x01\x7f\x0e\x82|<\xfc\x81|\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x80\x00\x00\x00\xff\xff\xff\xff\x08r\x1e\x00\xfc\x0c\x82|x\x86#\x00b\x00d\x00`\x9b\x18\x00h\xfc\xfb\x01\xc0\x9a\x83|\xc0\xf4\xfb\x01\x18\x0e\xa0|`\x9b\x18\x00x\x86#\x00\x05\x00\x00\x00\xb8\xf4\xfb\x01\x00\x00\x00\x00.\x93\x80|\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00h\x15>w\x05\x00\x00\x00\xf1W\x00\x00\xd8\xf4\xfb\x01\x8e\x0c\xa0|\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x00\x00\xf8\xf4\xfb\x01Y\x0b\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x05@\x00\x80\\x00\x00\x00\xf1W\x00\x00\xf1W\x00\x00 \xf5\xfb\x01%\x0c\xa0|\x00\x00\x00\x00\xa8\xf5\xbc|\x00\x00\x00\x00h\xfc\xfb\x01\xdcF_w\xc8\xd4Ow\xff\xff\xff\xff\xf1W\x00\x00<\xf5\xfb\x01\xba\xa0\x9e|\x02\x00\x00\x00\x00\x00\x00\x00\xb8:$\x00\x03\x00\x07\x80\xa4\xf5\xfb\x01p\xf5\xfb\x01 |
FAILURE | 3221225508 | |
| 09:15:19,574 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => MountPointManager DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
FAILURE | 0x00000000 | |
| 09:15:19,574 | 1676 | DeviceIoControl |
DeviceHandle => 0x0000029c OutBuffer => \x08\x00\x00\x00D\x00:\x00\x00\x00\x00\x00 IoControlCode => 7143476 InBuffer => `\x00\\x00?\x00?\x00\\x00V\x00o\x00l\x00u\x00m\x00e\x00{\x00e\x006\x00c\x007\x001\x006\x00a\x000\x00-\x00b\x005\x006\x001\x00-\x001\x001\x00e\x001\x00-\x009\x008\x004\x009\x00-\x008\x000\x006\x00d\x006\x001\x007\x002\x006\x009\x006\x00f\x00}\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000001 | |
| 09:15:19,574 | 1676 | RegCreateKeyExW |
Handle => 0x0000029c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e6c716a0-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegSetValueExW |
Handle => 0x0000029c Buffer => D\x00r\x00i\x00v\x00e\x00\x00\x00 ValueName => BaseClass Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x0000029c SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243af0 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x000002a2 Registry => 0x80000000 SubKey => Directory |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002a2 SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x000002a2 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x000002a2 |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000029e SubKey => ShellEx\IconHandler |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x0000029e DataLength => 0 ValueName => DocObject Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x0000029e DataLength => 0 ValueName => BrowseInPlace Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000029e SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x000002a2 Registry => 0x80000000 SubKey => Folder |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000002a2 SubKey => Clsid |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x0000029e DataLength => 0 ValueName => IsShortcut Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x0000029e DataLength => 2 ValueName => AlwaysShowExt Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegQueryValueExW |
Handle => 0x0000029e DataLength => 0 ValueName => NeverShowExt Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,574 | 1676 | RegCloseKey |
Handle => 0x000002a2 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243af0 | |
| 09:15:19,584 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\My Documents |
SUCCESS | 0x00243af0 | |
| 09:15:19,584 | 1676 | LdrGetProcedureAddress |
Ordinal => 66 FunctionName => FunctionAddress => 0x7c9f063c ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | LdrGetProcedureAddress |
Ordinal => 100 FunctionName => FunctionAddress => 0x7c9ec059 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,584 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 DataLength => 4 ValueName => UseDesktopIniCache Type => 33282048 |
FAILURE | 0x00000002 | |
| 09:15:19,584 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\My Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x000002a0 FileInformation => P\x00\x00\x00\x00\x00\x00\x00J\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtReadFile |
Buffer => [DeleteOnCopy]
Owner=TDW
Personalized=5
PersonalizedName=My Documents
FileHandle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUninitialize FunctionAddress => 0x774fee46 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCreateKeyExW |
Handle => 0x000002a0 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCreateKeyExW |
Handle => 0x000002a0 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegSetValueExW |
Handle => 0x000002a0 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00\x00\x00 ValueName => Common Documents Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x000002a0 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243b60 | |
| 09:15:19,584 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00243b60 | |
| 09:15:19,584 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Documents |
SUCCESS | 0x00243b60 | |
| 09:15:19,584 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,584 | 1676 | NtQueryInformationFile |
FileHandle => 0x0000029c FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtQueryInformationFile |
FileHandle => 0x0000029c FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\All Users\Documents\desktop.ini DesiredAccess => 0x80100000 FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtQueryInformationFile |
FileHandle => 0x0000029c FileInformation => @\x00\x00\x00\x00\x00\x00\x00>\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtReadFile |
Buffer => [.ShellClassInfo]
LocalizedResourceName=@shell32.dll,-21785
FileHandle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00101000 BaseAddress => 0x01fc0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,594 | 1676 | RegCreateKeyExW |
Handle => 0x0000029c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCreateKeyExW |
Handle => 0x0000029c Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegSetValueExW |
Handle => 0x0000029c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x0000029c SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243af0 | |
| 09:15:19,604 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243af0 | |
| 09:15:19,604 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Desktop |
SUCCESS | 0x00243af0 | |
| 09:15:19,604 | 1676 | RegCreateKeyExW |
Handle => 0x000002a0 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegQueryValueExW |
Handle => 0x000002a0 Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCreateKeyExW |
Handle => 0x000002a0 Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegSetValueExW |
Handle => 0x000002a0 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00D\x00e\x00s\x00k\x00t\x00o\x00p\x00\x00\x00 ValueName => Common Desktop Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegOpenKeyExW |
Handle => 0x000002a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x000002a0 SubKey => {e6c716a2-b561-11e1-9849-806d6172696f}\ |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x000002a0 |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Generation |
SUCCESS | 0x00000000 | |
| 09:15:19,604 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243b60 | |
| 09:15:19,614 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users |
SUCCESS | 0x00243b60 | |
| 09:15:19,614 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Desktop |
SUCCESS | 0x00243b60 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegEnumValueW |
Index => 0 Handle => 0x0000029c DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x000002a2 Registry => 0x80000000 SubKey => CLSID\{AEB6717E-7E19-11D0-97EE-00C04FD91972}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegQueryValueExW |
Handle => 0x000002a2 Data => s\x00h\x00e\x00l\x00l\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegQueryValueExW |
Handle => 0x000002a2 DataLength => 0 ValueName => LoadWithoutCOM Type => 0 |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegCloseKey |
Handle => 0x000002a2 |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegEnumValueW |
Index => 1 Handle => 0x0000029c DataLength => 0 ValueName => {AEB6717E-7E19-11d0-97EE-00C04FD91972} Type => 33290996 |
FAILURE | 0x00000103 | |
| 09:15:19,614 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Associations |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .ade |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .adp |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .app |
FAILURE | 0x00000002 | |
| 09:15:19,614 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .asp |
SUCCESS | 0x00000000 | |
| 09:15:19,614 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => a\x00s\x00p\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .bas |
FAILURE | 0x00000002 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .bat |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => b\x00a\x00t\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .cer |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .chm |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => c\x00h\x00m\x00.\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .cmd |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => c\x00m\x00d\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .com |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => c\x00o\x00m\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,624 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .cpl |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => c\x00p\x00l\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegOpenKeyExW |
Handle => 0x0000029e Registry => 0x80000000 SubKey => .crt |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegQueryValueExW |
Handle => 0x0000029e Data => C\x00E\x00R\x00F\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegCloseKey |
Handle => 0x0000029e |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => .csh |
FAILURE | 0x00000002 | |
| 09:15:19,634 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject FunctionAddress => 0x76fd3f78 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,634 | 1676 | RegQueryValueExW |
Handle => 0x0000029c Data => 1 ValueName => Com+Enabled |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | RegCloseKey |
Handle => 0x0000029c |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | LdrLoadDll |
Flags => 33290296 BaseAddress => 0x76fd0000 FileName => CLBCATQ.DLL |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetCatalogObject2 FunctionAddress => 0x76fd4017 ModuleHandle => 0x76fd0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CLSIDFromOle1Class FunctionAddress => 0x775188b9 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | NtOpenKey |
DesiredAccess => 33554432 KeyHandle => 0x000002a0 ObjectAttributes => \Registry\User\S-1-5-21-1935655697-1606980848-1060284298-1003_Classes |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | RegOpenKeyExW |
Handle => 0x0000029c Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:19,644 | 1676 | RegOpenKeyExW |
Handle => 0x000002a8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002b0 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002b8 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002c0 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002c8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002d0 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002d8 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002e0 Registry => 0x80000002 SubKey => Software\Classes |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002e8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | NtOpenKey |
DesiredAccess => 16 KeyHandle => 0x000002f0 ObjectAttributes => \REGISTRY\USER |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x000002f8 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x00000300 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x00000308 Registry => 0x80000002 SubKey => Software\Classes\CLSID |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegOpenKeyExW |
Handle => 0x00000310 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegQueryValueExW |
Handle => 0x00000310 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | RegCloseKey |
Handle => 0x00000310 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeCriticalSectionAndSpinCount FunctionAddress => 0x7c80b8b9 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:19,654 | 1676 | NtCreateFile |
ShareAccess => 1 FileName => C:\WINDOWS\Registration\R000000000007.clb DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000310 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000310 FileInformation => \x00`\x00\x00\x00\x00\x00\x00\xf0W\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | NtSetInformationFile |
FileHandle => 0x00000310 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:19,664 | 1676 | NtReadFile |
Buffer => COM+\x01\x00\x00\x00\x01\x00\x12\x00$\x00\x00\x00\x00\x01\x01\x00c\x00\x00\x00\x00\x00\x00\x01\x01\x00\x00\x00\x00\x01\x10\x00\x00\x00\x00\x00\xc0\x00\x00\x00\x00\x00\x00F\x0e\x00\x00\x000\x01\x00\x00\xa0\x03\x00\x003_0\x00\xd0\x04\x00\x00\x0c\x00\x00\x003_1\x00\xdc\x04\x00\x00\x88\x02\x00\x003_2\x00d\x07\x00\x00<\x00\x00\x003_3\x00\xa0\x07\x00\x00\x90\x08\x00\x003_4\x000\x10\x00\x00(\x00\x00\x003_5\x00X\x10\x00\x00(\x00\x00\x003_6\x00\x80\x10\x00\x00(\x00\x00\x003_7\x00\xa8\x10\x00\x00\x88\x10\x00\x003_8\x000!\x00\x00\xa8 \x00\x003_9\x00\xd8*\x00\x00<\x04\x00\x003_10\x00\x00\x00\x00\x14/\x00\x00\x0c\x01\x00\x003_11\x00\x00\x00\x00 0\x00\x00\x1c\x00\x00\x003_12\x00\x00\x00\x00<0\x00\x00\x14\x00\x00\x003_16\x00\x00\x00\x00P0\x00\x00\x90\x0e\x00\x00#Schema\x00\xe0>\x00\x00 FileHandle => 0x00000310 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000310 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegQueryValueExW |
Handle => 0x00000310 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegCloseKey |
Handle => 0x00000310 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000312 Registry => 0x000002a2 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000316 Registry => 0x000002a2 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegCloseKey |
Handle => 0x00000312 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000312 Registry => 0x00000316 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x00000312 SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegQueryValueExW |
Handle => 0x0000031a DataLength => 1000 ValueName => InprocServer32 Type => 33357920 |
FAILURE | 0x00000002 | |
| 09:15:19,664 | 1676 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x00000312 SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegQueryValueExW |
Handle => 0x0000031a Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:15:19,664 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => InprocHandler32 |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => InprocHandlerX86 |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => LocalServer32 |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => LocalServer |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x00000316 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegQueryValueExW |
Handle => 0x0000031a DataLength => 100 ValueName => AppID Type => 33290088 |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegCloseKey |
Handle => 0x00000312 |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000312 Registry => 0x00000316 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x0000031a Registry => 0x00000312 SubKey => InprocServer32 |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegQueryValueExW |
Handle => 0x0000031a Data => B\x00o\x00t\x00h\x00\x00\x00 ValueName => ThreadingModel |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegCloseKey |
Handle => 0x0000031a |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegCloseKey |
Handle => 0x00000312 |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000312 Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4} |
SUCCESS | 0x00000000 | |
| 09:15:19,674 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000312 SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:19,674 | 1676 | RegCloseKey |
Handle => 0x00000312 |
SUCCESS | 0x00000000 | |
| 09:15:19,684 | 1676 | LdrLoadDll |
Flags => 33286968 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,684 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllGetClassObject FunctionAddress => 0x7e1e603a ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DllCanUnloadNow FunctionAddress => 0x7e1e2eec ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x00000322 Registry => 0x80000000 SubKey => CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\InProcServer32 |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegQueryValueExW |
Handle => 0x00000322 Data => C\x00:\x00\\x00W\x00I\x00N\x00D\x00O\x00W\x00S\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00u\x00r\x00l\x00m\x00o\x00n\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | LdrLoadDll |
Flags => 33289640 BaseAddress => 0x7e1e0000 FileName => C:\WINDOWS\system32\urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x00000320 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x00000328 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegOpenKeyExA |
Handle => 0x0000032c Registry => 0x00000328 SubKey => Ranges\ |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 0 MaxValueNameLength => 0 ValueCount => 0 MaxSubKeyLength => 0 KeyHandle => 0x0000032c SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegCloseKey |
Handle => 0x0000032c |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | NtCreateSection |
ObjectAttributes => C:\ntdll DesiredAccess => 0x000f0007 SectionHandle => 0x0000032c FileHandle => 0x00000000 |
SUCCESS | 0x40000000 | |
| 09:15:19,694 | 1676 | ZwMapViewOfSection |
SectionOffset => 0x01fbf5f8 SectionHandle => 0x0000032c ProcessHandle => 0xffffffff BaseAddress => 0x020e0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,694 | 1676 | RegOpenKeyExW |
Handle => 0x00000330 Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000330 Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000330 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x00000330 SubKey => 0 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x00000330 SubKey => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x00000330 SubKey => 2 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x00000330 SubKey => 3 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x00000330 SubKey => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000330 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 0 Handle => 0x00000330 Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 1 Handle => 0x00000330 Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 2 Handle => 0x00000330 Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 3 Handle => 0x00000330 Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 4 Handle => 0x00000330 Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 5 Handle => 0x00000330 Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000330 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 0 Handle => 0x00000330 Name => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 33 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 1 Handle => 0x00000330 Name => 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 219 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => ProxyBypass Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => IntranetName Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => 1 ValueName => UNCAsIntranet Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 2 Handle => 0x00000330 Name => 2 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 71 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 3 Handle => 0x00000330 Name => 3 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 1 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 4 Handle => 0x00000330 Name => 4 Class => |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000338 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => 3 ValueName => Flags |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000338 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000334 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegEnumKeyExW |
Index => 5 Handle => 0x00000330 Name => 4 Class => |
FAILURE | 0x00000103 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000332 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\ |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\C\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000000 SubKey => PROTOCOLS\Name-Space Handler\*\ |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Classes\PROTOCOLS\Handler\C |
FAILURE | 0x00000002 | |
| 09:15:19,704 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => kernel32 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetLongPathNameW FunctionAddress => 0x7c8133e3 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:19,704 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00243b28 | |
| 09:15:19,704 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00243b28 | |
| 09:15:19,704 | 1676 | LdrLoadDll |
Flags => 33285480 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCreateKeyExW |
Handle => 0x00000330 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegQueryValueExW |
Handle => 0x00000330 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCreateKeyExW |
Handle => 0x00000330 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegSetValueExW |
Handle => 0x00000330 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00C\x00o\x00o\x00k\x00i\x00e\x00s\x00\x00\x00 ValueName => Cookies Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,704 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:19,704 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader |
SUCCESS | 0x00243b28 | |
| 09:15:19,714 | 1676 | FindFirstFileExW |
FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
SUCCESS | 0x00243b28 | |
| 09:15:19,714 | 1676 | RegOpenKeyExA |
Handle => 0x00000330 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000330 Data => 0 ValueName => 1806 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000330 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000330 DataLength => 4 ValueName => Security_HKLM_only Type => 33289500 |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000330 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000330 SubKey => FEATURE_RESPECT_OBJECTSAFETY_POLICY_KB905547 |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000330 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000328 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000320 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000320 ObjectAttributes => \Registry\Machine\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | NtQueryValueKey |
Information => 1 KeyHandle => 0x00000320 ValueName => TransparentEnabled Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000270 SubKey => .exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000322 Registry => 0x80000000 SubKey => .exe |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000322 Data => e\x00x\x00e\x00f\x00i\x00l\x00e\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x0000032a Registry => 0x80000000 SubKey => exefile |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000032a SubKey => CurVer |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000332 Registry => 0x0000032a SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x0000032a |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x0000032a Registry => 0x00000332 SubKey => shell\open |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x0000032a SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000336 Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x0000032a SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000336 DataLength => 256 ValueName => command Type => 33290200 |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000336 Registry => 0x0000032a SubKey => command |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000336 Data => "\x00%\x001\x00"\x00 \x00%\x00*\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x00000336 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000032a SubKey => ddeexec |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => Applications\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000334 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\ShellNoRoam |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv |
FAILURE | 3221225781 | 1 time |
| 09:15:19,714 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetProfileType FunctionAddress => 0x77f96930 ModuleHandle => 0x00400000 |
FAILURE | 3221225594 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x00000338 Registry => 0x00000334 SubKey => MUICache |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserDefaultUILanguage FunctionAddress => 0x7c813100 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x00000338 Data => ValueName => LangID |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 520 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 33289760 |
FAILURE | 0x00000002 | |
| 09:15:19,714 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | LdrLoadDll |
Flags => 33288528 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:19,714 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeW FunctionAddress => 0x77c0138c ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:19,734 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:15:19,734 | 1676 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:19,734 | 1676 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x0000033c FileHandle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:19,734 | 1676 | ZwMapViewOfSection |
SectionOffset => 0x01fbeeec SectionHandle => 0x0000033c ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,744 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoW FunctionAddress => 0x77c0166f ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe |
FAILURE | 3221225781 | |
| 09:15:19,754 | 1676 | NtCreateFile |
ShareAccess => 5 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x0000033c FileHandle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | ZwMapViewOfSection |
SectionOffset => 0x01fbeedc SectionHandle => 0x0000033c ProcessHandle => 0xffffffff BaseAddress => 0x020f0000 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueW FunctionAddress => 0x77c01805 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 68 ValueName => CutList Type => 7 |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegQueryValueExW |
Handle => 0x0000033c Data => ValueName => CutList |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x00000338 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:19,754 | 1676 | RegSetValueExW |
Handle => 0x0000033c Buffer => E\x00u\x00l\x00a\x00 \x00d\x00i\x00s\x00p\x00l\x00a\x00y\x00\x00\x00 ValueName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe DesiredAccess => 0x80100180 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00s?\xb30\x9a\xcd\x01\xe0\x13\xeeR\x8a\xa2\xcf\x01\x00s?\xb30\x9a\xcd\x01\xd0\xf3\x9c\xc3\xe6\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtSetInformationFile |
FileHandle => 0x0000033c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtReadFile |
Buffer => MZ\x90\x00\x03\x00\x00\x00\x04\x00\x00\x00\xff\xff\x00\x00\xb8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\x00\x00\x00 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtSetInformationFile |
FileHandle => 0x0000033c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtReadFile |
Buffer => PE\x00\x00L\x01\x05\x00\xb0\xc5_P\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00"\x01\x0b\x01
\x00\x00\xaa\x00\x00\x00\x84\x00\x00\x00\x00\x00\x00\xa9\xad\x00\x00\x00\x10\x00\x00\x00\xc0\x00\x00\x00\x00@\x00\x00\x10\x00\x00\x00\x02\x00\x00 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtSetInformationFile |
FileHandle => 0x0000033c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtReadFile |
Buffer => \x05\x00\x01\x00 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtSetInformationFile |
FileHandle => 0x0000033c FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | NtReadFile |
Buffer => \x02\x00@\x81 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 4 ValueName => InheritConsoleHandles Type => 33289916 |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 4 ValueName => RestrictRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 4 ValueName => DisallowRun Type => 33290472 |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | 1 time |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
FAILURE | 0x00000002 | |
| 09:15:19,764 | 1676 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Policies\Explorer |
SUCCESS | 0x00000000 | |
| 09:15:19,764 | 1676 | RegQueryValueExW |
Handle => 0x0000033c DataLength => 4 ValueName => NoRunasInstallPrompt Type => 33287748 |
FAILURE | 0x00000002 | |
| 09:15:19,774 | 1676 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:19,774 | 1676 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\App Paths\Eula.exe |
FAILURE | 0x00000002 | |
| 09:15:20,886 | 1676 | CreateProcessInternalW |
ApplicationName => C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe ProcessId => 976 CommandLine => "C:\Program Files\Adobe\Reader 11.0\Reader\Eula.exe" Adobe Reader XI;65758;1033 ThreadHandle => 0x0000034c ProcessHandle => 0x00000344 ThreadId => 1364 CreationFlags => 0x04000410 |
SUCCESS | 0x00000001 | |
| 09:15:20,906 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x774e0000 FileName => ole32.dll |
SUCCESS | 0x00000000 | |
| 09:15:20,906 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => browseui.dll |
FAILURE | 3221225781 | 1 time |
| 09:15:20,906 | 1676 | RegCloseKey |
Handle => 0x0000032a |
SUCCESS | 0x00000000 | |
| 09:15:20,906 | 1676 | RegCloseKey |
Handle => 0x00000322 |
SUCCESS | 0x00000000 | |
| 09:15:20,906 | 1676 | RegCloseKey |
Handle => 0x00000332 |
SUCCESS | 0x00000000 | |
| 09:15:20,986 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:20,986 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:20,986 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:20,986 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:20,986 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\UserCache.bin DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:20,996 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:20,996 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \xf0\x07\xaaS\x8a\xa2\xcf\x01\xf0\x07\xaaS\x8a\xa2\xcf\x01\xf0\x07\xaaS\x8a\xa2\xcf\x01\xf0\x07\xaaS\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00AL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:24,161 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:24,551 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x0000034c Class => |
SUCCESS | 0x00000000 | |
| 09:15:24,561 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x0000034c Class => |
SUCCESS | 0x00000000 | |
| 09:15:24,571 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,571 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,571 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,571 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,571 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,571 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,581 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,581 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,581 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,581 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,581 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,581 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,581 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,591 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,591 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,591 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,591 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,601 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,601 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,601 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,601 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,611 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,611 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,611 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,611 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,611 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,611 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,621 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,621 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,631 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243b28 | |
| 09:15:24,631 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0 DesiredAccess => 196639 KeyHandle => 0x0000034c Class => |
SUCCESS | 0x00000000 | |
| 09:15:24,631 | 1676 | NtCreateKey |
ObjectAttributes => Software\Adobe\Adobe Acrobat\11.0\DiskCabs DesiredAccess => 196639 KeyHandle => 0x0000034c Class => |
SUCCESS | 0x00000000 | |
| 09:15:24,641 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,641 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,641 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,641 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,641 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,641 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,641 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,641 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,641 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,651 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,651 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,651 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,661 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,661 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,671 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,671 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243b28 | |
| 09:15:24,681 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,681 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:24,681 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:24,681 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:24,681 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Collab |
SUCCESS | 0x00243b28 | |
| 09:15:24,691 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,691 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:24,701 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,701 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:24,711 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,711 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:24,711 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:24,711 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\desktop.ini |
SUCCESS | 0x00243b28 | |
| 09:15:25,663 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,663 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,663 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,663 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,663 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,663 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,663 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,663 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,663 | 1676 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000344 ObjectAttributes => \REGISTRY\USER\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:25,663 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000344 SubKey => SOFTWARE\Microsoft\Cryptography\Providers\Type 001 |
FAILURE | 0x00000002 | |
| 09:15:25,673 | 1676 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x00000344 DataLength => 40 ValueName => Name Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x00000344 Data => Microsoft Strong Cryptographic Provider\x00 ValueName => Name |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegOpenKeyExA |
Handle => 0x00000344 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Strong Cryptographic Provider |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x00000344 Data => 1 ValueName => Type |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x00000344 DataLength => 11 ValueName => Image Path Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x00000344 Data => rsaenh.dll\x00 ValueName => Image Path |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetDllHandle |
ModuleHandle => 0x68000000 FileName => rsaenh.dll |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPAcquireContext FunctionAddress => 0x6800fb46 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPReleaseContext FunctionAddress => 0x6800f017 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenKey FunctionAddress => 0x6800afb1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDeriveKey FunctionAddress => 0x6800d086 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyKey FunctionAddress => 0x68009460 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetKeyParam FunctionAddress => 0x68009638 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetKeyParam FunctionAddress => 0x68009a22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPExportKey FunctionAddress => 0x6800ba24 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPImportKey FunctionAddress => 0x6800bf8a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPEncrypt FunctionAddress => 0x68006c8e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDecrypt FunctionAddress => 0x68007100 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPCreateHash FunctionAddress => 0x680074ba ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashData FunctionAddress => 0x68007e56 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPHashSessionKey FunctionAddress => 0x68007fa0 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDestroyHash FunctionAddress => 0x680082d1 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSignHash FunctionAddress => 0x6800da22 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPVerifySignature FunctionAddress => 0x6800df0a ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGenRandom FunctionAddress => 0x6800d7a7 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetUserKey FunctionAddress => 0x68009562 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetProvParam FunctionAddress => 0x68009e6d ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetProvParam FunctionAddress => 0x68009f9c ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPSetHashParam FunctionAddress => 0x6800a56f ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPGetHashParam FunctionAddress => 0x6800c891 ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateKey FunctionAddress => 0x6800aaae ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CPDuplicateHash FunctionAddress => 0x6800852e ModuleHandle => 0x68000000 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegOpenKeyExA |
Handle => 0x0000034c Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x0000034c DataLength => 37 ValueName => MachineGuid Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegQueryValueExA |
Handle => 0x0000034c Data => 99d6ed61-80b2-42d4-8c72-45c08cbdb8ae\x00 ValueName => MachineGuid |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegCloseKey |
Handle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:25,673 | 1676 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\Offload |
FAILURE | 0x00000002 | |
| 09:15:25,673 | 1676 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,683 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,683 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\P2VGQPEC DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Flash Player\AssetCache\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,693 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00120089 CreateDisposition => 2 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,703 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,703 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => @\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,703 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,703 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => @\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01@\xc1yV\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00EL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x8a\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b28 | |
| 09:15:25,703 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\FAP1.tmp |
SUCCESS | 0x00243b28 | |
| 09:15:25,713 | 1676 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\FAP1.tmp DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,713 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,743 | 1676 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NtCreateEvent FunctionAddress => 0x7c90d070 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:25,773 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,773 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,773 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b28 | |
| 09:15:25,773 | 1676 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b28 | |
| 09:15:25,773 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp DesiredAccess => 0x00100020 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,773 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,773 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:25,973 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:25,973 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:25,973 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:25,973 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:25,973 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:25,973 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:25,973 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:25,973 | 1676 | RegOpenKeyExW |
Handle => 0x00000344 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Internet Explorer |
SUCCESS | 0x00000000 | |
| 09:15:25,973 | 1676 | RegQueryValueExW |
Handle => 0x00000344 Data => 6\x00.\x000\x00.\x002\x009\x000\x000\x00.\x005\x005\x001\x002\x00\x00\x00 ValueName => Version |
SUCCESS | 0x00000000 | |
| 09:15:25,973 | 1676 | RegCloseKey |
Handle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,013 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,013 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,053 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,053 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,053 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,053 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,053 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,083 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,083 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,083 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,214 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,214 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,224 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,224 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,224 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,244 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,244 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,244 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01\x007\xc9V\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf6)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xce\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,274 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,274 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,274 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1656 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1656 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1656 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1656 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,284 | 1656 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000034c |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1656 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000328 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1456 | CreateRemoteThread |
Parameter => 0x00000000 ProcessHandle => 0xffffffff ThreadId => 0 StartRoutine => 0x7c910230 CreationFlags => 4 |
SUCCESS | 0x00000344 | |
| 09:15:26,284 | 1456 | NtResumeThread |
SuspendCount => 1 ThreadHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,284 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b28 | |
| 09:15:26,294 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000034c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x007\xc9V\x8a\xa2\xcf\x01\xf0\xda\xd0V\x8a\xa2\xcf\x01\xf0\xda\xd0V\x8a\xa2\xcf\x01\xf0\xda\xd0V\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:26,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:26,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:26,304 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Application Data\Adobe\Acrobat\11.0\SharedDataEvents DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:26,304 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:26,304 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \x007\xc9V\x8a\xa2\xcf\x01P\xe9\xd3V\x8a\xa2\xcf\x01\xf0\xda\xd0V\x8a\xa2\xcf\x01\xf0\xda\xd0V\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xf5)\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xbe\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:32,773 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000340 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:32,773 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000340 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com |
SUCCESS | 0x00000000 | |
| 09:15:32,813 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000340 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\Acrobat.com.v2 |
SUCCESS | 0x00000000 | |
| 09:15:32,853 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000340 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | 3 times |
| 09:15:33,684 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000340 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0 |
SUCCESS | 0x00000000 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,684 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,684 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,694 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,694 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,704 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,704 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \xd7j71\xaf\x91\xcf\x01\xd7j71\xaf\x91\xcf\x01\xd7j71\xaf\x91\xcf\x01\xd7j71\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\xb7\xf2\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00|\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,704 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,704 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,714 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,724 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,754 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,754 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,754 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:33,754 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:33,754 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,754 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,754 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => \xd7j71\xaf\x91\xcf\x01\x10\xb0>[\x8a\xa2\xcf\x01\xd7j71\xaf\x91\xcf\x01\xd7j71\xaf\x91\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\xb7\xf2\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xfcK\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00|\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,835 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,835 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,835 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:33,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:33,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:33,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:33,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:33,845 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:33,845 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:33,845 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:34,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:34,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:34,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:34,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:34,065 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:34,075 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:34,075 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:34,075 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:34,075 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b60 | |
| 09:15:34,075 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b60 | |
| 09:15:34,075 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b60 | |
| 09:15:34,085 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:34,085 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:34,085 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000344 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:34,305 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:34,305 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:34,315 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:34,315 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:34,315 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b60 | |
| 09:15:34,315 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:34,315 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b60 | |
| 09:15:34,315 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000344 |
SUCCESS | 0x00000000 | |
| 09:15:34,315 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000340 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:34,335 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b60 | |
| 09:15:34,335 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00243b60 | |
| 09:15:35,567 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoRegisterClassObject FunctionAddress => 0x77517e90 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,567 | 2036 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegQueryValueExW |
Handle => 0x00000340 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000340 Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegQueryValueExW |
Handle => 0x00000340 Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x00000340 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000342 Registry => 0x000002a2 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000342 SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x000002a2 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x00000342 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000342 Registry => 0x0000033e SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000342 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000342 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x0000034a Registry => 0x00000342 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegQueryValueExW |
Handle => 0x0000034a DataLength => 1000 ValueName => LocalServer32 Type => 33358952 |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x0000034a |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000342 SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000342 SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x0000034a Registry => 0x00000342 SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegQueryValueExW |
Handle => 0x0000034a Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x0000034a |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegOpenKeyExW |
Handle => 0x0000034a Registry => 0x00000342 SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegQueryValueExW |
Handle => 0x0000034a Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x0000034a |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | RegCloseKey |
Handle => 0x00000342 |
SUCCESS | 0x00000000 | |
| 09:15:35,577 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => C:\WINDOWS\system32\winlogon.exe |
FAILURE | 3221225781 | 1 time |
| 09:15:35,587 | 2036 | RegOpenKeyExW |
Handle => 0x00000358 Registry => 0x80000002 SubKey => Software\Microsoft\Ole |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | RegQueryValueExW |
Handle => 0x00000358 DataLength => 4 ValueName => MaximumAllowedAllocationSize Type => 36238932 |
FAILURE | 0x00000002 | |
| 09:15:35,587 | 2036 | RegCloseKey |
Handle => 0x00000358 |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | LdrLoadDll |
Flags => 36238896 BaseAddress => 0x02290000 FileName => xpsp2res.dll |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000000 SubKey => AppID\AcroRd32.exe |
FAILURE | 0x00000002 | |
| 09:15:35,587 | 2036 | RegOpenKeyExW |
Handle => 0x0000035c Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\OLE |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | RegQueryValueExW |
Handle => 0x0000035c DataLength => 256 ValueName => DefaultAccessPermission Type => 2337184 |
FAILURE | 0x00000002 | |
| 09:15:35,587 | 2036 | RegCloseKey |
Handle => 0x0000035c |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x00000360 |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | NtSetInformationFile |
FileHandle => 0x00000360 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:35,587 | 2036 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000360 |
SUCCESS | 0x00000000 | |
| 09:15:35,587 | 2036 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa6E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x00000360 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000035c ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000360 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000360 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | CreateThread |
ThreadId => 1272 StartRoutine => 0x77e76c7d Parameter => 0x001eee20 CreationFlags => 0 |
SUCCESS | 0x00000358 | |
| 09:15:35,597 | 2036 | LdrLoadDll |
Flags => 36239812 BaseAddress => 0x774e0000 FileName => OLE32 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetClassObject FunctionAddress => 0x775156c5 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetMarshalSizeMax FunctionAddress => 0x7752d6c0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoMarshalInterface FunctionAddress => 0x7750ea71 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoUnmarshalInterface FunctionAddress => 0x7752d7f4 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => StringFromIID FunctionAddress => 0x7754659b ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoGetPSClsid FunctionAddress => 0x775197f0 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemAlloc FunctionAddress => 0x774fd060 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoTaskMemFree FunctionAddress => 0x774fd044 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoCreateInstance FunctionAddress => 0x7750057e ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoReleaseMarshalData FunctionAddress => 0x7750df23 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DcomChannelSetHResult FunctionAddress => 0x7752b1b7 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,597 | 2036 | CreateThread |
ThreadId => 680 StartRoutine => 0x774fe43b Parameter => 0x001e6c80 CreationFlags => 0 |
SUCCESS | 0x0000036c | |
| 09:15:35,597 | 680 | LdrLoadDll |
Flags => 41287540 BaseAddress => 0x774e0000 FileName => OLE32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 680 | NtDelayExecution |
Milliseconds => 60000 |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegQueryValueExW |
Handle => 0x0000033c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000033c Registry => 0x80000002 SubKey => Software\Microsoft\COM3 |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegQueryValueExW |
Handle => 0x0000033c Data => ValueName => REGDBVersion |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x000002a2 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033e SubKey => TreatAs |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000376 Registry => 0x000002a2 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000033e Registry => 0x00000376 SubKey => CLSID\{B801CA65-A1FC-11D0-85AD-444553540000} |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033e SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033e SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000037a Registry => 0x0000033e SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegQueryValueExW |
Handle => 0x0000037a DataLength => 1000 ValueName => LocalServer32 Type => 33358952 |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000037a |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033e SubKey => InprocServer32 |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033e SubKey => InprocServerX86 |
FAILURE | 0x00000002 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000037a Registry => 0x0000033e SubKey => InprocHandler32 |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegQueryValueExW |
Handle => 0x0000037a Data => o\x00l\x00e\x003\x002\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegCloseKey |
Handle => 0x0000037a |
SUCCESS | 0x00000000 | |
| 09:15:35,607 | 2036 | RegOpenKeyExW |
Handle => 0x0000037a Registry => 0x0000033e SubKey => LocalServer32 |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | RegQueryValueExW |
Handle => 0x0000037a Data => "\x00C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00A\x00d\x00o\x00b\x00e\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00 \x001\x001\x00.\x000\x00\\x00R\x00e\x00a\x00d\x00e\x00r\x00\\x00A\x00c\x00r\x00o\x00R\x00d\x003\x002\x00.\x00e\x00x\x00e\x00"\x00\x00\x00 ValueName => |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | RegCloseKey |
Handle => 0x0000037a |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | RegCloseKey |
Handle => 0x0000033e |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoResumeClassObjects FunctionAddress => 0x77526d50 ModuleHandle => 0x774e0000 |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,617 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,617 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,627 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,627 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,627 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,647 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,647 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,647 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,647 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,657 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,657 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,657 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,657 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,657 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,657 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,657 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R4468.tmp |
SUCCESS | 4294967295 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,667 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,677 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,697 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,707 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\Security |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,717 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,717 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,727 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,727 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,727 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,737 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,737 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,737 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,737 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,737 | 2036 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,747 | 2036 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\aug14audit.pdf DesiredAccess => 0x00100080 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,747 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,757 | 2036 | RegCreateKeyExW |
Handle => 0x0000033c Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x0000033c SubKey => cRecentFiles |
FAILURE | 0x00000002 | |
| 09:15:35,757 | 2036 | RegCreateKeyExW |
Handle => 0x00000378 Access => 131078 Registry => 0x80000001 Class => SubKey => Software\Adobe\Acrobat Reader\11.0\AVGeneral\cRecentFiles\c1 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => D\x00O\x00S\x00\x00\x00 ValueName => aFS Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => /\x00C\x00/\x00D\x00O\x00C\x00U\x00M\x00E\x00~\x001\x00/\x00T\x00D\x00W\x00/\x00L\x00O\x00C\x00A\x00L\x00S\x00~\x001\x00/\x00T\x00e\x00m\x00p\x00/\x00a\x00u\x00g\x001\x004\x00a\x00u\x00d\x00i\x00t\x00.\x00p\x00d\x00f\x00\x00\x00 ValueName => tDIText Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => ValueName => sDI Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => ValueName => sDate Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => 127671 ValueName => uFileSize Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegSetValueExW |
Handle => 0x00000378 Buffer => 1 ValueName => uPageCount Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegCloseKey |
Handle => 0x00000378 |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | RegCloseKey |
Handle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,757 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,767 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:35,767 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,777 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,777 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,777 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,777 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,777 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,817 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,827 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,827 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,827 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,827 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,827 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,827 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,837 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,837 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,837 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,837 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,837 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,857 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,857 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,857 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,857 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,857 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01`\x81\x98R\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,857 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,867 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,867 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,867 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,867 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,867 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,867 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\xc0\x88\\x8a\xa2\xcf\x01\x90\xc0\x88\\x8a\xa2\xcf\x01\x90\xc0\x88\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00GL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:35,908 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,908 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,908 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,908 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,918 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243b98 | |
| 09:15:35,918 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:35,918 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:35,918 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,248 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,258 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,258 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,258 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,258 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,258 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x10\xe0\xc5\\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x00243b98 | |
| 09:15:36,268 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,268 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x10\xe0\xc5\\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01\xf0\xe2\x92U\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,278 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => @g\xc7\\x8a\xa2\xcf\x01@g\xc7\\x8a\xa2\xcf\x01@g\xc7\\x8a\xa2\xcf\x01@g\xc7\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00JL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xda\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,278 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,278 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,288 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,288 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,288 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,288 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,298 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,298 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,308 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,308 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,308 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,308 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xd0\xfc\xcb\\x8a\xa2\xcf\x01\xd0\xfc\xcb\\x8a\xa2\xcf\x01\xd0\xfc\xcb\\x8a\xa2\xcf\x01\xd0\xfc\xcb\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,318 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,318 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,328 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,328 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,328 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,338 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,338 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,348 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,348 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x90\x19\xd2\\x8a\xa2\xcf\x01\x90\x19\xd2\\x8a\xa2\xcf\x01\x90\x19\xd2\\x8a\xa2\xcf\x01\x90\x19\xd2\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,348 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,348 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,358 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,358 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,358 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,358 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,368 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,368 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,368 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,368 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,378 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,378 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,378 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,378 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,378 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,388 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,388 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\8FMRS1AR\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,388 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,398 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01 \xaf\xd6\\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00RL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\A96XG38P\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,398 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,398 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xd0\xfc\xcb\\x8a\xa2\xcf\x01\x00\x84\xcd\\x8a\xa2\xcf\x01\x00\x84\xcd\\x8a\xa2\xcf\x01\x00\x84\xcd\\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00NL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,398 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\CTE5UXOV\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,408 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,408 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x90\x19\xd2\\x8a\xa2\xcf\x01\x90\x19\xd2\\x8a\xa2\xcf\x01\x90\x19\xd2\\x8a\xa2\xcf\x01\xc0\xa0\xd3\\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00PL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,408 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\G1638HIR\desktop.ini DesiredAccess => 0x00120089 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,418 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,418 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01\xa0u\xca\\x8a\xa2\xcf\x01\x06\x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00LL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x89\x00\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xec\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,418 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,428 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00243b98 | |
| 09:15:36,428 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,428 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x10S\xde\\x8a\xa2\xcf\x01\x10S\xde\\x8a\xa2\xcf\x01\x10S\xde\\x8a\xa2\xcf\x01\x10S\xde\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,428 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies\index.dat |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,438 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,438 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x10S\xde\\x8a\xa2\xcf\x01\x10S\xde\\x8a\xa2\xcf\x01\xf0\xe2\x92U\x8a\xa2\xcf\x01\x10S\xde\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00TL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Cookies |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Cookies\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,438 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,438 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,448 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,448 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,448 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,458 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,458 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xa0\xe8\xe2\\x8a\xa2\xcf\x01\xa0\xe8\xe2\\x8a\xa2\xcf\x01\xa0\xe8\xe2\\x8a\xa2\xcf\x01\xa0\xe8\xe2\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\index.dat |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,458 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,458 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \xa0\xe8\xe2\\x8a\xa2\xcf\x01\xa0\xe8\xe2\\x8a\xa2\xcf\x01\xf0\xe2\x92U\x8a\xa2\xcf\x01\xa0\xe8\xe2\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00WL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb4\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,458 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,468 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,468 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,468 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x00000000 |
FAILURE | 3221225658 | |
| 09:15:36,478 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\ DesiredAccess => 0x00100000 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,478 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,478 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,488 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,488 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => 0~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,488 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,488 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => 0~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x010~\xe7\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00C\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00XL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xb8\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History |
SUCCESS | 0x00243b98 | |
| 09:15:36,488 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\History\History.IE5\desktop.ini |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\History\History.IE5\desktop.ini DesiredAccess => 0x00100100 CreateDisposition => 1 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x00\xe9\x90|8G9\x00\x08O9\x00|\xd8\x90|\xea\x82 |
FAILURE | 3221225506 | |
| 09:15:36,498 | 2036 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000378 ObjectAttributes => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000378 ObjectAttributes => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtOpenKey |
DesiredAccess => 15 KeyHandle => 0x00000378 ObjectAttributes => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat |
SUCCESS | 0x00243b98 | |
| 09:15:36,498 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000033c |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000378 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,498 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000033c FileInformation => \x10\xe0\xc5\\x8a\xa2\xcf\x01\x10\xe0\xc5\\x8a\xa2\xcf\x01`\x05\xe9\\x8a\xa2\xcf\x01`\x05\xe9\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00IL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xd6\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,548 | 2036 | LdrLoadDll |
Flags => 36240396 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,548 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetOpenA FunctionAddress => 0x771c578e ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,548 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => FromCacheTimeout Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,548 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => SecureProtocols Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => CertificateRevocation Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableKeepAlive Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisablePassport Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => CacheMode Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => Security_HKLM_only Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => EnableHttp1_1 Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x00000384 Data => 1 ValueName => EnableHttp1_1 |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 4 ValueName => Security_HKLM_only Type => 900 |
FAILURE | 0x00000002 | |
| 09:15:36,558 | 2036 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,558 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x00000384 DataLength => 4 ValueName => ProxyHttp1.1 Type => 900 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => ProxyHttp1.1 Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x00000380 DataLength => 4 ValueName => ProxyHttp1.1 Type => 896 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000033c Data => 1 ValueName => EnableNegotiate |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableBasicOverClearChannel Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExW |
Handle => 0x0000037c Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => Feature_ClientAuthCertFilter Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => SyncMode5 Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,568 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => FixupKey Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,568 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000037c DataLength => 4 ValueName => SessionStartTimeDefaultDeltaSecs Type => 892 |
FAILURE | 0x00000002 | |
| 09:15:36,578 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x0000037c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000002 SubKey => System\Setup |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x00000380 Data => 0 ValueName => SystemSetupInProgress |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x00000380 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x00000384 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x00000388 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => Client UrlCache MMF Ver 5.2\x00 ValueName => Signature |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000038c DataLength => 54 ValueName => Cache Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000038c DataLength => 22 ValueName => Cookies Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000038c DataLength => 37 ValueName => History Type => 2 |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000384 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x0000038c DataLength => 4 ValueName => PerUserItem Type => 908 |
FAILURE | 0x00000002 | |
| 09:15:36,578 | 2036 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x0000037c SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:36,578 | 2036 | RegQueryValueExA |
Handle => 0x00000390 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000384 SubKey => Content |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | LdrLoadDll |
Flags => 36238072 BaseAddress => 0x7c9c0000 FileName => shell32.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathA FunctionAddress => 0x7ca2ac11 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files DesiredAccess => 0x00100100 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => 327323 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x00000394 Registry => 0x00000390 SubKey => Paths |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x00000398 Registry => 0x00000394 SubKey => Path1 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x0000039c Registry => 0x00000394 SubKey => Path2 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x00000394 SubKey => Path3 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x00000394 SubKey => Path4 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegOpenKeyExA |
Handle => 0x000003a8 Registry => 0x00000390 SubKey => Special Paths |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegSetValueExA |
Handle => 0x00000394 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\x00 ValueName => Directory Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegSetValueExA |
Handle => 0x00000394 Buffer => 4 ValueName => Paths Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegSetValueExA |
Handle => 0x00000398 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache1\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegSetValueExA |
Handle => 0x0000039c Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache2\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,589 | 2036 | RegSetValueExA |
Handle => 0x000003a0 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache3\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegSetValueExA |
Handle => 0x000003a4 Buffer => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\Cache4\x00 ValueName => CachePath Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegSetValueExA |
Handle => 0x00000398 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegSetValueExA |
Handle => 0x0000039c Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegSetValueExA |
Handle => 0x000003a0 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegSetValueExA |
Handle => 0x000003a4 Buffer => 81830 ValueName => CacheLimit Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x00000394 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x000003a8 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x00000384 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x00000390 DataLength => 4 ValueName => PerUserItem Type => 912 |
FAILURE | 0x00000002 | |
| 09:15:36,599 | 2036 | RegOpenKeyExA |
Handle => 0x000003a8 Registry => 0x0000037c SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x000003a8 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x000003a8 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000384 SubKey => Cookies |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => Cookie:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegOpenKeyExA |
Handle => 0x00000390 Registry => 0x00000384 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x00000390 DataLength => 4 ValueName => PerUserItem Type => 912 |
FAILURE | 0x00000002 | |
| 09:15:36,599 | 2036 | RegOpenKeyExA |
Handle => 0x000003a8 Registry => 0x0000037c SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:36,599 | 2036 | RegQueryValueExA |
Handle => 0x000003a8 Data => 1 ValueName => PerUserItem |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x000003a8 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegOpenKeyExA |
Handle => 0x0000038c Registry => 0x00000384 SubKey => History |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCreateKeyExW |
Handle => 0x00000390 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegQueryValueExW |
Handle => 0x00000390 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCreateKeyExW |
Handle => 0x00000390 Access => 33554432 Registry => 0x80000001 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegSetValueExW |
Handle => 0x00000390 Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00H\x00i\x00s\x00t\x00o\x00r\x00y\x00\x00\x00 ValueName => History Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History DesiredAccess => 0x00100100 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => Visited:\x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegQueryValueExA |
Handle => 0x0000038c Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x0000038c |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x00000384 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | RegCloseKey |
Handle => 0x0000037c |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | NtOpenMutant |
Handle => 0x0000037c MutexName => _!MSFTHISTORY!_ |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | NtOpenMutant |
Handle => 0x00000384 MutexName => c:!documents and settings!tdw!local settings!temporary internet files!content.ie5! |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetDiskFreeSpaceExA FunctionAddress => 0x7c83038b ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:36,609 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtSetInformationFile |
FileHandle => 0x00000380 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtSetInformationFile |
FileHandle => 0x00000380 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000380 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_Temporary Internet Files_Content.IE5_index.dat_245760 SectionHandle => 0x00000388 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228f924 SectionHandle => 0x00000388 ProcessHandle => 0xffffffff BaseAddress => 0x02100000 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenMutant |
Handle => 0x0000038c MutexName => c:!documents and settings!tdw!cookies! |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100001 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Cookies\ DesiredAccess => 0x00100100 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,619 | 2036 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtSetInformationFile |
FileHandle => 0x00000390 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000390 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Cookies\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000390 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Cookies_index.dat_32768 SectionHandle => 0x000003a8 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228f924 SectionHandle => 0x000003a8 ProcessHandle => 0xffffffff BaseAddress => 0x02140000 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtOpenMutant |
Handle => 0x00000394 MutexName => c:!documents and settings!tdw!local settings!history!history.ie5! |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100001 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtOpenFile |
ShareAccess => 3 FileName => C:\ DesiredAccess => 0x00100001 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtSetInformationFile |
FileHandle => 0x00000398 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtSetInformationFile |
FileHandle => 0x00000398 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,629 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000398 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\index.dat DesiredAccess => 0xc0100080 CreateDisposition => 3 FileHandle => 0x00000398 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtOpenSection |
DesiredAccess => 0x00000002 ObjectAttributes => C:\C:_Documents and Settings_TDW_Local Settings_History_History.IE5_index.dat_32768 SectionHandle => 0x0000039c |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228f924 SectionHandle => 0x0000039c ProcessHandle => 0xffffffff BaseAddress => 0x02150000 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\Temporary Internet Files\Content.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtSetInformationFile |
FileHandle => 0x000003a0 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtOpenFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Local Settings\History\History.IE5\ DesiredAccess => 0x00100100 FileHandle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtSetInformationFile |
FileHandle => 0x000003a0 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x000003a0 SubKey => Extensible Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegEnumKeyExA |
Index => 0 Handle => 0x000003a4 Name => MSHist012014071820140719 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x000003a4 SubKey => MSHist012014071820140719 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 Data => 0 ValueName => CacheRepair |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 Data => %USERPROFILE%\Local Settings\History\History.IE5\MSHist012014071820140719\\x00 ValueName => CachePath |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 Data => :2014071820140719: \x00 ValueName => CachePrefix |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 Data => 8192 ValueName => CacheLimit |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 Data => 11 ValueName => CacheOptions |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegEnumKeyExA |
Index => 1 Handle => 0x000003a4 Name => MSHist012014071820140719 Class => |
FAILURE | 0x00000103 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:36,639 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => FEATURE_AUTOPROXY_CACHE_ANAME_KB921400 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,639 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | 2 times |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840387 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => FEATURE_TEMPORARYFILES_FOR_NOCACHE_840386 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239640 |
FAILURE | 0x00000002 | |
| 09:15:36,639 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,639 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => RETRY_HEADERONLYPOST_ONCONNECTIONRESET |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => FEATURE_CHUNK_TIMEOUT_KB914453 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a4 SubKey => FEATURE_CERT_TRUST_VERIFIED_KB936882 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableWorkerThreadHibernation Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableReadRange Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => SocketSendBufferLength Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => SocketReceiveBufferLength Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => KeepAliveTimeout Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => MaxHttpRedirects Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => MaxConnectionsPerServer Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => MaxConnectionsPer1_0Server Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => ServerInfoTimeout Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => ReceiveTimeOut Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableNTLMPreAuth Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => ScavengeCacheLowerBound Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => CertCacheNoValidate Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => ScavengeCacheFileLifeTime Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => Security_HKLM_only Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => ScavengeCacheFileLimit Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_BUFFERBREAKING_818408 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_SKIP_POST_RETRY_ON_INTERNETWRITEFILE_KB895954 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_ENSURE_FQDN_FOR_NEGOTIATE_KB899417 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_HTTP_DISABLE_NTLM_PREAUTH_IF_ABORTED_KB902409 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_PERMIT_CACHE_FOR_AUTHENTICATED_FTP_KB910274 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_WPAD_STORE_URL_AS_FQDN_KB903926 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_USE_CNAME_FOR_SPN_KB911149 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_KEEP_CACHE_INDEX_OPEN_KB899342 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_WAIT_TIME_THREAD_TERMINATE_KB886801 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExW |
Handle => 0x000003a0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239644 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003a0 SubKey => FEATURE_FIX_CHUNKED_PROXY_SCRIPT_DOWNLOAD_KB843289 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => HttpDefaultExpiryTimeSecs Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => FtpDefaultExpiryTimeSecs Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => GopherDefaultExpiryTimeSecs Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableCachingOfSSLPages Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => PerUserCookies Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => LeashLegacyCookies Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DisableNT4RasCheck Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => DialupUseLanSettings Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => DialupUseLanSettings Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => SendExtraCRLF Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => BypassFtpTimeCheck Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableGopher Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => ReleaseSocketDuringAuth Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => ReleaseSocketDuring401Auth Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WpadSearchAllDomains Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => DisableLegacyPreAuthAsServer Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,649 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => BypassHTTPNoCacheCheck Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => BypassSSLNoCacheCheck Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => EnableHttpTrace Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => EnableHttpTrace Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a4 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a4 DataLength => 4 ValueName => NoCheckAutodialOverRide Type => 932 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a4 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DontUseDNSLoadBalancing Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => NonBlockingClient32 Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003a0 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003a0 DataLength => 4 ValueName => ShareCredsWithWinHttp Type => 928 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003a0 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 66 ValueName => MimeExclusionListForCache Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c Data => multipart/mixed multipart/x-mixed-replace multipart/x-byteranges \x00 ValueName => MimeExclusionListForCache |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 0 ValueName => HeaderExclusionListForCache Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DnsCacheEnabled Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DnsCacheEntries Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => DnsCacheTimeout Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c Data => ValueName => WarnOnPost |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WarnAlwaysOnPost Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c Data => 0 ValueName => WarnOnZoneCrossing |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WarnOnBadCertSending Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WarnOnBadCertRecving Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WarnOnPostRedirect Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => AlwaysDrainOnRedirect Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => WarnOnHTTPSToHTTPRedirect Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | NtOpenMutant |
Handle => 0x000003a0 MutexName => WininetStartupMutex |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => GlobalUserOffline Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | NtOpenMutant |
Handle => 0x000003ac MutexName => WininetConnectionMutex |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | NtCreateMutant |
Handle => 0x000003b0 InitialOwner => 0 MutexName => |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | NtOpenMutant |
Handle => 0x000003b4 MutexName => WininetProxyRegistryMutex |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => rnaapp.exe |
FAILURE | 3221225781 | 1 time |
| 09:15:36,659 | 2036 | RegOpenKeyExA |
Handle => 0x000003b8 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x000003b8 DataLength => 11 ValueName => UrlEncoding Type => 1 |
FAILURE | 0x000000ea | |
| 09:15:36,659 | 2036 | RegCloseKey |
Handle => 0x000003b8 |
SUCCESS | 0x00000000 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => TruncateFileName Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,659 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => BadProxyExpiresTime Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,669 | 2036 | LdrLoadDll |
Flags => 36239980 BaseAddress => 0x71ad0000 FileName => wsock32 |
SUCCESS | 0x00000000 | |
| 09:15:36,669 | 2036 | LdrGetProcedureAddress |
Ordinal => 1 FunctionName => FunctionAddress => 0x71ac1040 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,669 | 2036 | LdrGetProcedureAddress |
Ordinal => 2 FunctionName => FunctionAddress => 0x71ab4480 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 3 FunctionName => FunctionAddress => 0x71ab3e2b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 4 FunctionName => FunctionAddress => 0x71ab4a07 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 5 FunctionName => FunctionAddress => 0x71ac0b68 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 6 FunctionName => FunctionAddress => 0x71ab3d10 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 7 FunctionName => FunctionAddress => 0x71ad2ed6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 8 FunctionName => FunctionAddress => 0x71ab2ead ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 9 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 10 FunctionName => FunctionAddress => 0x71ab2ee1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 11 FunctionName => FunctionAddress => 0x71ab45c1 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 12 FunctionName => FunctionAddress => 0x71ab3f50 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 13 FunctionName => FunctionAddress => 0x71ab8cd3 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 15 FunctionName => FunctionAddress => 0x71ab2e53 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 16 FunctionName => FunctionAddress => 0x71ad2e70 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 17 FunctionName => FunctionAddress => 0x71ad3001 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 18 FunctionName => FunctionAddress => 0x71ab30a8 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 19 FunctionName => FunctionAddress => 0x71ab4c27 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 20 FunctionName => FunctionAddress => 0x71ab2f51 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 21 FunctionName => FunctionAddress => 0x71ad2e30 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 22 FunctionName => FunctionAddress => 0x71ac0bf6 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 23 FunctionName => FunctionAddress => 0x71ab4211 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 52 FunctionName => FunctionAddress => 0x71ab5355 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 57 FunctionName => FunctionAddress => 0x71ab5449 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 111 FunctionName => FunctionAddress => 0x71ab3cce ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 112 FunctionName => FunctionAddress => 0x71ab2a5e ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,679 | 2036 | LdrGetProcedureAddress |
Ordinal => 115 FunctionName => FunctionAddress => 0x71ab6a55 ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 116 FunctionName => FunctionAddress => 0x71ab3fed ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 151 FunctionName => FunctionAddress => 0x71ab3f7b ModuleHandle => 0x71ad0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | WSAStartup |
VersionRequested => 0x00000101 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrLoadDll |
Flags => 36239980 BaseAddress => 0x71ab0000 FileName => ws2_32 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceBeginW FunctionAddress => 0x71ab35ef ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceEnd FunctionAddress => 0x71ab350e ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSALookupServiceNextW FunctionAddress => 0x71ab3181 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WSANSPIoctl FunctionAddress => 0x71ab5086 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getaddrinfo FunctionAddress => 0x71ab2a6f ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => freeaddrinfo FunctionAddress => 0x71ab2b0b ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => getnameinfo FunctionAddress => 0x71abc689 ModuleHandle => 0x71ab0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | CreateThread |
ThreadId => 1028 StartRoutine => 0x771d922e Parameter => 0x001fcd20 CreationFlags => 0 |
SUCCESS | 0x000003c0 | |
| 09:15:36,689 | 1028 | socket |
type => 2 protocol => 17 af => 2 |
SUCCESS | 0x000003c8 | |
| 09:15:36,689 | 1028 | bind |
ip => 127.0.0.1 socket => 0x000003c8 port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 1028 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x000003c8 OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x0f\x7f\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 1028 | connect |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0007 SectionHandle => 0x000003d4 FileHandle => 0x00000000 |
SUCCESS | 0x00000000 | |
| 09:15:36,689 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228fcb0 SectionHandle => 0x000003d4 ProcessHandle => 0xffffffff BaseAddress => 0x02160000 |
SUCCESS | 0x00000000 | |
| 09:15:36,699 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetSetStatusCallbackA FunctionAddress => 0x771d9064 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,699 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetConnectA FunctionAddress => 0x771c3452 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,699 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,699 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetQueryOptionW FunctionAddress => 0x771d5a5f ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpOpenRequestA FunctionAddress => 0x771c2af9 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Http Filters\RPA |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegQueryValueExW |
Handle => 0x000003e0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239748 |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e0 SubKey => FEATURE_INCLUDE_PORT_IN_SPN_KB908209 |
FAILURE | 0x00000002 | |
| 09:15:36,719 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,719 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,719 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,719 | 2036 | RegQueryValueExW |
Handle => 0x000003e0 DataLength => 4 ValueName => Security_HKLM_only Type => 36239744 |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x000003e0 SubKey => FEATURE_MIME_HANDLING |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegQueryValueExW |
Handle => 0x000003e4 DataLength => 4 ValueName => AcroRd32.exe Type => 36239716 |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegQueryValueExW |
Handle => 0x000003e4 DataLength => 4 ValueName => * Type => 36239716 |
FAILURE | 0x00000002 | |
| 09:15:36,729 | 2036 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,729 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,729 | 2036 | RegOpenKeyExA |
Handle => 0x000003e0 Registry => 0x80000002 SubKey => Software\Microsoft\Cryptography\OID |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegEnumKeyExA |
Index => 0 Handle => 0x000003e0 Name => EncodingType 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegOpenKeyExA |
Handle => 0x000003e4 Registry => 0x000003e0 SubKey => EncodingType 0 |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegOpenKeyExA |
Handle => 0x000003e8 Registry => 0x000003e4 SubKey => CertDllOpenStoreProv |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegEnumKeyExA |
Index => 0 Handle => 0x000003e8 Name => #16 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegOpenKeyExA |
Handle => 0x000003ec Registry => 0x000003e8 SubKey => #16 |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000003ec SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003ec Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:15:36,729 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003ec Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumKeyExA |
Index => 1 Handle => 0x000003e8 Name => Ldap Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExA |
Handle => 0x000003ec Registry => 0x000003e8 SubKey => Ldap |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 36 MaxValueNameLength => 8 ValueCount => 2 MaxSubKeyLength => 0 KeyHandle => 0x000003ec SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003ec Data => c\x00r\x00y\x00p\x00t\x00n\x00e\x00t\x00.\x00d\x00l\x00l\x00\x00\x00 ValueName => Dll |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003ec Data => L\x00d\x00a\x00p\x00P\x00r\x00o\x00v\x00O\x00p\x00e\x00n\x00S\x00t\x00o\x00r\x00e\x00\x00\x00 ValueName => FuncName |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumKeyExA |
Index => 2 Handle => 0x000003e8 Name => Ldap Class => |
FAILURE | 0x00000103 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e8 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumKeyExA |
Index => 1 Handle => 0x000003e0 Name => EncodingType 1 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExA |
Handle => 0x000003e4 Registry => 0x000003e0 SubKey => EncodingType 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x000003e4 SubKey => CertDllOpenStoreProv |
FAILURE | 0x00000002 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegEnumKeyExA |
Index => 2 Handle => 0x000003e0 Name => EncodingType 1 Class => |
FAILURE | 0x00000103 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e0 SubKey => Software\Microsoft\SystemCertificates\MY\PhysicalStores |
FAILURE | 0x00000002 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegOpenKeyExW |
Handle => 0x000003e0 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCreateKeyExW |
Handle => 0x000003e4 Access => 983103 Registry => 0x000003e0 Class => SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,739 | 2036 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:36,749 | 2036 | LdrLoadDll |
Flags => 36238248 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,749 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,749 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv.dll |
FAILURE | 3221225781 | |
| 09:15:36,749 | 2036 | NtCreateFile |
ShareAccess => 5 FileName => C:\WINDOWS\system32\userenv.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,749 | 2036 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000003e8 FileHandle => 0x000003e0 |
SUCCESS | 0x00000000 | |
| 09:15:36,749 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228f104 SectionHandle => 0x000003e8 ProcessHandle => 0xffffffff BaseAddress => 0x02960000 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x00000000 FileName => userenv.dll |
FAILURE | 3221225781 | |
| 09:15:36,759 | 2036 | NtCreateFile |
ShareAccess => 5 FileName => C:\WINDOWS\system32\userenv.dll DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003e8 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | NtCreateSection |
ObjectAttributes => DesiredAccess => 0x000f0005 SectionHandle => 0x000003e0 FileHandle => 0x000003e8 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228f0f4 SectionHandle => 0x000003e0 ProcessHandle => 0xffffffff BaseAddress => 0x02960000 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,759 | 2036 | LdrLoadDll |
Flags => 36238692 BaseAddress => 0x769c0000 FileName => userenv.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 149 FunctionName => FunctionAddress => 0x769c1bc9 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003e8 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003e8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x000003ec SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x000003ec Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x000003ec Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x000003ec Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x000003ec Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x000003ec Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x000003ec Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x000003ec Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x000003ec Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x000003ec Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x000003ec Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x000003ec Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x000003ec Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x000003ec Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x000003ec Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x000003ec Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x000003ec Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x000003ec ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x000003f0 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x000003f0 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegQueryValueExW |
Handle => 0x000003ec Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003ec Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrLoadDll |
Flags => 36237944 BaseAddress => 0x77fe0000 FileName => secur32.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetUserNameExW FunctionAddress => 0x77fe1c70 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetComputerObjectNameW FunctionAddress => 0x77febed4 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TranslateNameW FunctionAddress => 0x77fec06b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcceptSecurityContext FunctionAddress => 0x77fe5351 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => AcquireCredentialsHandleW FunctionAddress => 0x77fe3103 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DeleteSecurityContext FunctionAddress => 0x77fe2d0d ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeContextBuffer FunctionAddress => 0x77fe287e ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => FreeCredentialsHandle FunctionAddress => 0x77fe2b91 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitializeSecurityContextW FunctionAddress => 0x77fe5bd3 ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityContextToken FunctionAddress => 0x77fea43b ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QuerySecurityPackageInfoW FunctionAddress => 0x77fe386c ModuleHandle => 0x77fe0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrLoadDll |
Flags => 36237420 BaseAddress => 0x5b860000 FileName => netapi32.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetDcNameW FunctionAddress => 0x5b86d189 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsGetSiteNameW FunctionAddress => 0x5b87299f ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleGetPrimaryDomainInformation FunctionAddress => 0x5b86cfdd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => DsRoleFreeMemory FunctionAddress => 0x5b86cedd ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetApiBufferFree FunctionAddress => 0x5b867a00 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetGroups FunctionAddress => 0x5b894df0 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => NetUserGetInfo FunctionAddress => 0x5b86acf1 ModuleHandle => 0x5b860000 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => PIPE\lsarpc DesiredAccess => 0xc0100080 CreateDisposition => 1 FileHandle => 0x000003f4 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtSetInformationFile |
FileHandle => 0x000003f4 FileInformation => |
SUCCESS | 0x00000000 | 1 time |
| 09:15:36,769 | 2036 | NtWriteFile |
Buffer => \x05\x00\x0b\x03\x10\x00\x00\x00H\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00j(\x199\x0c\xb1\xd0\x11\x9b\xa8\x00\xc0O\xd9.\xf5\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003f4 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | NtReadFile |
Buffer => \x05\x00\x0c\x03\x10\x00\x00\x00D\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x0c\x00\PIPE\lsass\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003f4 |
SUCCESS | 0x00000000 | |
| 09:15:36,769 | 2036 | RegOpenKeyExW |
Handle => 0x000003f8 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegQueryValueExW |
Handle => 0x000003f8 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCreateKeyExW |
Handle => 0x000003f8 Access => 131103 Registry => 0x000003ec Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegQueryValueExW |
Handle => 0x000003f8 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtQueryInformationFile |
FileHandle => 0x000003f8 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtReadFile |
Buffer => FileHandle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x000003f8 Registry => 0x000003ec SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003f8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003f8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003f8 DataLength => 4096 ValueName => TMP Type => 36237580 |
FAILURE | 0x00000103 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003f8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003f8 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003f8 DataLength => 4096 ValueName => TMP Type => 36237580 |
FAILURE | 0x00000103 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x000003f8 Registry => 0x000003ec SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003f8 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003f8 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003f8 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x000003f8 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x000003f8 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x000003f8 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x000003f8 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x000003f8 DataLength => 4096 ValueName => HOMEPATH Type => 36237580 |
FAILURE | 0x00000103 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x000003f8 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x000003f8 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x000003f8 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x000003f8 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x000003f8 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x000003f8 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x000003f8 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x000003f8 DataLength => 4096 ValueName => HOMEPATH Type => 36237580 |
FAILURE | 0x00000103 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003f8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003ec |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02170000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003e8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x000003e8 Registry => 0x000003e4 SubKey => Software\Microsoft\SystemCertificates\MY |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003e4 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x000003e4 Registry => 0x000003e8 SubKey => |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e4 SubKey => Certificates |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\Certificates\* |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => |
FAILURE | 2147483654 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e4 SubKey => CRLs |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CRLs\* |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => |
FAILURE | 2147483654 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e4 SubKey => CTLs |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\SystemCertificates\My\CTLs\* |
SUCCESS | 0x00243ce8 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00p\x03]\xb9\xd5I\xcd\x01p\xf7\xddf\xe8\x91\xcf\x01`\xb0M2oI\xcd\x01PKl\xb9\xd5I\xcd\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x14\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00.\x00.\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | NtQueryDirectoryFile |
FileName => FileHandle => 0x000003ec FileInformation => |
FAILURE | 2147483654 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x000003e4 SubKey => Keys |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x000003e8 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrLoadDll |
Flags => 36239648 BaseAddress => 0x76c30000 FileName => wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WinVerifyTrust FunctionAddress => 0x76c32f2c ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => WTHelperProvDataFromStateData FunctionAddress => 0x76c416e6 ModuleHandle => 0x76c30000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrLoadDll |
Flags => 36239532 BaseAddress => 0x77c00000 FileName => VERSION.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoSizeA FunctionAddress => 0x77c019ef ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrLoadDll |
Flags => 36239576 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => GetFileVersionInfoA FunctionAddress => 0x77c01a40 ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrLoadDll |
Flags => 36237596 BaseAddress => 0x76c30000 FileName => C:\WINDOWS\system32\wintrust.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => VerQueryValueA FunctionAddress => 0x77c018aa ModuleHandle => 0x77c00000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrLoadDll |
Flags => 36239948 BaseAddress => 0x767f0000 FileName => schannel |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InitSecurityInterfaceA FunctionAddress => 0x77fe6a3c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslCrackCertificate FunctionAddress => 0x767f2e31 ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SslFreeCertificate FunctionAddress => 0x767f2e0c ModuleHandle => 0x767f0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x77a80000 FileName => crypt32 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptInstallDefaultContext FunctionAddress => 0x77abcb30 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CryptUninstallDefaultContext FunctionAddress => 0x77abcc94 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFindChainInStore FunctionAddress => 0x77ac0d1e ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CertFreeCertificateChain FunctionAddress => 0x77a9b041 ModuleHandle => 0x77a80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000408 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegQueryValueExW |
Handle => 0x00000408 DataLength => 4 ValueName => Security_HKLM_only Type => 36239448 |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x00000408 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000408 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000408 SubKey => FEATURE_HTTP_USERNAME_PASSWORD_DISABLE |
FAILURE | 0x00000002 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x00000408 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpAddRequestHeadersA FunctionAddress => 0x771c40ca ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => HttpSendRequestA FunctionAddress => 0x771c60a1 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:36,779 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => QueueUserWorkItem FunctionAddress => 0x7c830a52 ModuleHandle => 0x7c800000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrLoadDll |
Flags => 36240876 BaseAddress => 0x76ee0000 FileName => RASAPI32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasDialW FunctionAddress => 0x76ef68db ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasHangUpW FunctionAddress => 0x76ee8bcd ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumEntriesW FunctionAddress => 0x76ee3ce9 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryDialParamsW FunctionAddress => 0x76ee7ad0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetEntryDialParamsW FunctionAddress => 0x76ee917c ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEditPhonebookEntryW FunctionAddress => 0x76ee6839 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasCreatePhonebookEntryW FunctionAddress => 0x76ee6767 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetErrorStringW FunctionAddress => 0x76ee7d38 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,799 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetConnectStatusW FunctionAddress => 0x76ee70cb ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasEnumConnectionsW FunctionAddress => 0x76ee2520 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetEntryPropertiesW FunctionAddress => 0x76ee9a5b ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetCredentialsW FunctionAddress => 0x76eeacb1 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetCredentialsW FunctionAddress => 0x76eeb078 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasGetAutodialAddressA FunctionAddress => 0x76eebbe0 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RasSetAutodialAddressA FunctionAddress => 0x76eec044 ModuleHandle => 0x76ee0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrLoadDll |
Flags => 36240724 BaseAddress => 0x76e80000 FileName => RTUTILS.DLL |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceRegisterExA FunctionAddress => 0x76e8212f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterA FunctionAddress => 0x76e83ff9 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDeregisterExA FunctionAddress => 0x76e82d77 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfA FunctionAddress => 0x76e81aad ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TracePrintfExA FunctionAddress => 0x76e819e2 ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => TraceDumpExA FunctionAddress => 0x76e8253f ModuleHandle => 0x76e80000 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegCreateKeyExA |
Handle => 0x00000440 Access => 983103 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Tracing |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegQueryValueExA |
Handle => 0x00000440 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegCloseKey |
Handle => 0x00000440 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegOpenKeyExA |
Handle => 0x00000448 Registry => 0x80000002 SubKey => Software\Microsoft\Tracing\RASAPI32 |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:36,809 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:36,819 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:15:36,819 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,819 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:15:36,819 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:36,819 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:15:36,829 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:15:36,829 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:15:36,829 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,829 | 2036 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x002461d8 | |
| 09:15:36,829 | 2036 | OpenServiceW |
ServiceControlManager => 0x002461d8 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00246160 | |
| 09:15:36,829 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:36,829 | 2036 | OpenSCManagerA |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00246200 | |
| 09:15:36,849 | 2036 | LdrLoadDll |
Flags => 36240880 BaseAddress => 0x722b0000 FileName => sensapi.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,849 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsNetworkAlive FunctionAddress => 0x722b1260 ModuleHandle => 0x722b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 2036 | NtOpenSection |
DesiredAccess => 0x00000004 ObjectAttributes => C:\SENS Information Cache SectionHandle => 0x0000045c |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 2036 | ZwMapViewOfSection |
SectionOffset => 0x0228fdc8 SectionHandle => 0x0000045c ProcessHandle => 0xffffffff BaseAddress => 0x02ae0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243d20 | |
| 09:15:36,859 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243d20 | |
| 09:15:36,859 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243d20 | |
| 09:15:36,859 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243d20 | |
| 09:15:36,859 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000460 |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000464 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000460 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80d\x90\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,859 | 2036 | NtWriteFile |
Buffer => \x05\x00\x0e\x03\x10\x00\x00\x00H\x00\x00\x00\x02\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x01\x00\x00\x00\x01\x00\x01\x00xW4\x124\x12\xcd\xab\xef\x00\x01#Eg\x89\xab\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003f4 |
SUCCESS | 0x00000000 | |
| 09:15:36,859 | 2036 | NtReadFile |
Buffer => \x05\x00\x0f\x03\x10\x00\x00\x008\x00\x00\x00\x02\x00\x00\x00\xb8\x10\xb8\x10\xa7E\x00\x00\x00\x00\x02\x00\x01\x00\x00\x00\x00\x00\x00\x00\x04]\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00+\x10H`\x02\x00\x00\x00 FileHandle => 0x000003f4 |
SUCCESS | 0x00000000 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:36,869 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000468 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,869 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000464 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \x08 ]\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243d20 | |
| 09:15:36,869 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:36,879 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000468 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,879 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000464 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\x8f!]\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,879 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243d20 | |
| 09:15:36,879 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:36,879 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000468 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,879 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000464 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\x16#]\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01P\xdd\x8e\\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x00243d20 | |
| 09:15:36,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x00243d20 | |
| 09:15:36,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x00243d20 | |
| 09:15:36,889 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x00243d20 | |
| 09:15:36,889 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:36,889 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000468 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:36,889 | 1676 | NtQueryInformationFile |
FileHandle => 0x00000464 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0\x9d$]\x8a\xa2\xcf\x01\xb0\x9d$]\x8a\xa2\xcf\x01\xb0\x9d$]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00YL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:36,909 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegOpenKeyExA |
Handle => 0x00000464 Registry => 0x80000002 SubKey => SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegQueryValueExA |
Handle => 0x00000464 DataLength => 4 ValueName => ProxySettingsPerUser Type => 1124 |
FAILURE | 0x00000002 | |
| 09:15:36,909 | 2036 | RegCloseKey |
Handle => 0x00000464 |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | LdrLoadDll |
Flags => 36239324 BaseAddress => 0x7c900000 FileName => ntdll.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => RtlConvertSidToUnicodeString FunctionAddress => 0x7c914c35 ModuleHandle => 0x7c900000 |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegOpenKeyExW |
Handle => 0x00000464 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x00000464 SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegQueryValueExA |
Handle => 0x00000468 Data => 1 ValueName => MigrateProxy |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,909 | 2036 | LdrLoadDll |
Flags => 36239248 BaseAddress => 0x7c9c0000 FileName => SHELL32.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => SHGetFolderPathW FunctionAddress => 0x7c9eed76 ModuleHandle => 0x7c9c0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegCreateKeyExW |
Handle => 0x0000046c Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => %\x00A\x00L\x00L\x00U\x00S\x00E\x00R\x00S\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | LdrLoadDll |
Flags => 36237916 BaseAddress => 0x769c0000 FileName => USERENV.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => ExpandEnvironmentStringsForUserW FunctionAddress => 0x769c7733 ModuleHandle => 0x769c0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x00000470 SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,919 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000470 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000470 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000470 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000470 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000470 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x00000470 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x00000470 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x00000470 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000470 Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000470 Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000470 Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000470 Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000470 Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x00000470 Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x00000470 Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x00000470 Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000470 ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000474 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000474 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000474 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCreateKeyExW |
Handle => 0x00000474 Access => 131103 Registry => 0x00000470 Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegQueryValueExW |
Handle => 0x00000474 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,929 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000474 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | NtReadFile |
Buffer => FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x00000470 SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,939 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x00000470 SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,939 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02af0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCreateKeyExW |
Handle => 0x0000046c Access => 33554432 Registry => 0x80000002 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegSetValueExW |
Handle => 0x0000046c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => Common AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:36,949 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\Ras\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCreateKeyExW |
Handle => 0x00000470 Access => 33554432 Registry => 0x0000046c Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => A\x00l\x00l\x00 \x00U\x00s\x00e\x00r\x00s\x00\x00\x00 ValueName => AllUsersProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => System\CurrentControlSet\Control\Session Manager\Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryInfoKeyW |
MaxClassLength => 0 MaxValueLength => 124 MaxValueNameLength => 22 ValueCount => 13 MaxSubKeyLength => 0 KeyHandle => 0x0000046c SubKeyCount => 0 Class => |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x0000046c Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x0000046c Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x0000046c Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x0000046c Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00c\x00m\x00d\x00.\x00e\x00x\x00e\x00\x00\x00 ValueName => ComSpec |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00s\x00y\x00s\x00t\x00e\x00m\x003\x002\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00;\x00%\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00S\x00y\x00s\x00t\x00e\x00m\x003\x002\x00\\x00W\x00b\x00e\x00m\x00\x00\x00 ValueName => Path |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\x00\x00 ValueName => windir |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x0000046c Data => N\x00O\x00\x00\x00 ValueName => FP_NO_HOST_CHECK |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x0000046c Data => W\x00i\x00n\x00d\x00o\x00w\x00s\x00_\x00N\x00T\x00\x00\x00 ValueName => OS |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x0000046c Data => x\x008\x006\x00\x00\x00 ValueName => PROCESSOR_ARCHITECTURE |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x0000046c Data => 1\x005\x00\x00\x00 ValueName => PROCESSOR_LEVEL |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x0000046c Data => x\x008\x006\x00 \x00F\x00a\x00m\x00i\x00l\x00y\x00 \x001\x005\x00 \x00M\x00o\x00d\x00e\x00l\x00 \x001\x000\x007\x00 \x00S\x00t\x00e\x00p\x00p\x00i\x00n\x00g\x00 \x001\x00,\x00 \x00A\x00u\x00t\x00h\x00e\x00n\x00t\x00i\x00c\x00A\x00M\x00D\x00\x00\x00 ValueName => PROCESSOR_IDENTIFIER |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 8 Handle => 0x0000046c Data => 6\x00b\x000\x001\x00\x00\x00 ValueName => PROCESSOR_REVISION |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 9 Handle => 0x0000046c Data => 1\x00\x00\x00 ValueName => NUMBER_OF_PROCESSORS |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 10 Handle => 0x0000046c Data => .\x00C\x00O\x00M\x00;\x00.\x00E\x00X\x00E\x00;\x00.\x00B\x00A\x00T\x00;\x00.\x00C\x00M\x00D\x00;\x00.\x00V\x00B\x00S\x00;\x00.\x00V\x00B\x00E\x00;\x00.\x00J\x00S\x00;\x00.\x00J\x00S\x00E\x00;\x00.\x00W\x00S\x00F\x00;\x00.\x00W\x00S\x00H\x00\x00\x00 ValueName => PATHEXT |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 11 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegEnumValueW |
Index => 12 Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00R\x00o\x00o\x00t\x00%\x00\\x00T\x00E\x00M\x00P\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x0000046c ObjectAttributes => \Registry\Machine\System\CurrentControlSet\Control\ComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | NtOpenKey |
DesiredAccess => 131097 KeyHandle => 0x00000474 ObjectAttributes => ActiveComputerName |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | NtQueryValueKey |
Information => T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 KeyHandle => 0x00000474 ValueName => ComputerName Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\x00\x00 ValueName => ProfilesDirectory |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => D\x00e\x00f\x00a\x00u\x00l\x00t\x00 \x00U\x00s\x00e\x00r\x00\x00\x00 ValueName => DefaultUserProfile |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => ProgramFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x0000046c Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x80000002 SubKey => Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x00000474 Data => %\x00S\x00y\x00s\x00t\x00e\x00m\x00D\x00r\x00i\x00v\x00e\x00%\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => ProfileImagePath |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCreateKeyExW |
Handle => 0x00000474 Access => 131103 Registry => 0x0000046c Class => SubKey => Software\Microsoft\Windows NT\CurrentVersion\Winlogon |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegQueryValueExW |
Handle => 0x00000474 Data => 1\x00\x00\x00 ValueName => ParseAutoexec |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,949 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => c:\autoexec.bat DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000474 FileInformation => \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | NtReadFile |
Buffer => FileHandle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x0000046c SubKey => Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TEMP |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,959 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => %\x00U\x00S\x00E\x00R\x00P\x00R\x00O\x00F\x00I\x00L\x00E\x00%\x00\\x00L\x00o\x00c\x00a\x00l\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00e\x00m\x00p\x00\x00\x00 ValueName => TMP |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,959 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Local Settings |
SUCCESS | 0x00243d20 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 DataLength => 4096 ValueName => TMP Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000474 Registry => 0x0000046c SubKey => Volatile Environment |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 0 Handle => 0x00000474 Data => \\x00\\x00T\x00U\x00R\x00B\x00O\x00P\x00C\x00\x00\x00 ValueName => LOGONSERVER |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 1 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => CLIENTNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 2 Handle => 0x00000474 Data => C\x00o\x00n\x00s\x00o\x00l\x00e\x00\x00\x00 ValueName => SESSIONNAME |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 3 Handle => 0x00000474 Data => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => APPDATA |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 4 Handle => 0x00000474 Data => C\x00:\x00\x00\x00 ValueName => HOMEDRIVE |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 5 Handle => 0x00000474 Data => \x00\x00 ValueName => HOMESHARE |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 6 Handle => 0x00000474 Data => \\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\x00\x00 ValueName => HOMEPATH |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegEnumValueW |
Index => 7 Handle => 0x00000474 DataLength => 4096 ValueName => HOMEPATH Type => 36237476 |
FAILURE | 0x00000103 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000474 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | NtFreeVirtualMemory |
FreeType => 0x00008000 ProcessHandle => 0xffffffff RegionSize => 0x00001000 BaseAddress => 0x02af0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000003 SubKey => S-1-5-21-1935655697-1606980848-1060284298-1003 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExW |
Handle => 0x0000046c Access => 33554432 Registry => 0x00000470 Class => SubKey => Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegSetValueExW |
Handle => 0x0000046c Buffer => C\x00:\x00\\x00D\x00o\x00c\x00u\x00m\x00e\x00n\x00t\x00s\x00 \x00a\x00n\x00d\x00 \x00S\x00e\x00t\x00t\x00i\x00n\x00g\x00s\x00\\x00T\x00D\x00W\x00\\x00A\x00p\x00p\x00l\x00i\x00c\x00a\x00t\x00i\x00o\x00n\x00 \x00D\x00a\x00t\x00a\x00\x00\x00 ValueName => AppData Type => 1 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Microsoft\Network\Connections\Pbk\*.pbk |
SUCCESS | 4294967295 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 2 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegSetValueExA |
Handle => 0x00000468 Buffer => 1 ValueName => MigrateProxy Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x00000464 SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 Data => 0 ValueName => ProxyEnable |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 2084 ValueName => ProxyServer Type => 1128 |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 2084 ValueName => ProxyOverride Type => 1128 |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 2084 ValueName => AutoConfigURL Type => 1128 |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 1 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 1 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 56 ValueName => DefaultConnectionSettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 Data => ValueName => DefaultConnectionSettings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 131078 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegSetValueExA |
Handle => 0x00000468 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegDeleteValueA |
Handle => 0x00000468 ValueName => ProxyServer |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegDeleteValueA |
Handle => 0x00000468 ValueName => ProxyOverride |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegDeleteValueA |
Handle => 0x00000468 ValueName => AutoConfigURL |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 2 Registry => 0x80000005 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegSetValueExA |
Handle => 0x00000468 Buffer => 0 ValueName => ProxyEnable Type => 4 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x00000468 Access => 1 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 DataLength => 56 ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExA |
Handle => 0x00000468 Data => ValueName => SavedLegacySettings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCreateKeyExA |
Handle => 0x0000046c Access => 2 Registry => 0x00000464 Class => SubKey => Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000468 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegSetValueExA |
Handle => 0x0000046c Buffer => ValueName => SavedLegacySettings Type => 3 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x0000046c |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrLoadDll |
Flags => 36240264 BaseAddress => 0x7e1e0000 FileName => urlmon.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateSecurityManager FunctionAddress => 0x7e1e30e7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetCreateZoneManager FunctionAddress => 0x7e1e9bd7 ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => CoInternetIsFeatureEnabledForUrl FunctionAddress => 0x7e1ebb5e ModuleHandle => 0x7e1e0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x0000046c Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000468 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExW |
Handle => 0x00000470 DataLength => 4 ValueName => Security_HKLM_only Type => 36238380 |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000470 Registry => 0x80000002 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x80000001 SubKey => Software\Microsoft\Internet Explorer\Main\FeatureControl |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExW |
Handle => 0x00000000 Registry => 0x00000470 SubKey => FEATURE_VALIDATE_URLHOSTNAME |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | 1 time |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegCloseKey |
Handle => 0x00000000 |
FAILURE | 0x00000006 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x00000468 SubKey => Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegOpenKeyExA |
Handle => 0x00000000 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\adobe.com |
FAILURE | 0x00000002 | |
| 09:15:36,959 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => 1 ValueName => IntranetName |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | RegQueryValueExW |
Handle => 0x0000046c Data => 1 ValueName => ProxyBypass |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrLoadDll |
Flags => 36238460 BaseAddress => 0x771b0000 FileName => WININET.dll |
SUCCESS | 0x00000000 | |
| 09:15:36,959 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => IsHostInProxyBypassList FunctionAddress => 0x771d3350 ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegOpenKeyExA |
Handle => 0x00000470 Registry => 0x00000468 SubKey => ProtocolDefaults\ |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => 3 ValueName => https |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegOpenKeyExA |
Handle => 0x00000470 Registry => 0x80000001 SubKey => Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegQueryValueExW |
Handle => 0x00000470 Data => 1 ValueName => 1A10 |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | RegCloseKey |
Handle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,969 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 1 time |
| 09:15:36,969 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000390 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | 22 times |
| 09:15:36,979 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,979 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000390 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtCreateFile |
ShareAccess => 1 FileName => C:\Documents and Settings\TDW\Cookies\tdw@adobe[2].txt DesiredAccess => 0x80100080 CreateDisposition => 1 FileHandle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000470 FileInformation => p\x00\x00\x00\x00\x00\x00\x00k\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtSetInformationFile |
FileHandle => 0x00000470 FileInformation => |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtReadFile |
Buffer => s_vi
[CS]v1|29D65EC68507B15F-4000010EE001FA5C[CE]
adobe.com/
1024
839917312
30527303
1280773376
30380519
*
FileHandle => 0x00000470 |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:36,999 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000390 FileInformation => \x00\x80\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,009 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:37,009 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,009 | 2036 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
FAILURE | 0x00002af9 | |
| 09:15:37,009 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,019 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,029 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,029 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103a8 | |
| 09:15:37,029 | 1676 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\assets DesiredAccess => 0x00100001 CreateDisposition => 2 FileHandle => 0x00000478 |
SUCCESS | 0x00000000 | |
| 09:15:37,029 | 1676 | NtOpenDirectoryObject |
DirectoryHandle => 0x0000047c DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,340 | 2036 | getaddrinfo |
ServiceName => NodeName => service-updates.adobe.com |
SUCCESS | 0x00000000 | |
| 09:15:37,340 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000047c | |
| 09:15:37,340 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000047c |
SUCCESS | 0x00000000 | |
| 09:15:37,370 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000047c port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:37,370 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000047c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,370 | 2036 | connect |
socket => 0x0000047c |
FAILURE | 4294967295 | |
| 09:15:37,370 | 1028 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:15:37,370 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:37,370 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:15:37,630 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,630 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,630 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,630 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,630 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,630 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,670 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,670 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,670 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,670 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,670 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,670 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,680 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,680 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,680 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,680 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,680 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,680 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,700 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,700 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,700 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,700 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,700 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,700 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,710 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,710 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,710 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,710 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,710 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,710 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,740 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,740 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,740 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,740 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b103e0 | |
| 09:15:37,740 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,740 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,740 | 2036 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,740 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtOpenKey |
DesiredAccess => 65547 KeyHandle => 0x00000490 ObjectAttributes => Software\Adobe\Adobe Synchronizer\11.0\CredentialsV2 |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,750 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,760 | 2036 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,790 | 2036 | NtCreateKey |
ObjectAttributes => Software\Adobe\Acrobat Reader\11.0\ServicesRdr DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,790 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,790 | 2036 | NtCreateKey |
ObjectAttributes => ccom_2E_adobe_2E_acrobat_2E_services_2E_DEXShare DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,790 | 2036 | NtCreateKey |
ObjectAttributes => cSharePanel DesiredAccess => 196639 KeyHandle => 0x00000490 Class => |
SUCCESS | 0x00000000 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,810 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,810 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,810 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,810 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf02\xb1]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:37,810 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,820 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,820 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf02\xb1]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b103e0 | |
| 09:15:37,820 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,820 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,820 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xba\xb2]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,820 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,820 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\ DesiredAccess => 0x00100001 CreateDisposition => 1 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,830 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp\acrord32_sbx\A9R4469.tmp |
SUCCESS | 4294967295 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1 |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | FindFirstFileExW |
FileName => C:\DOCUME~1\TDW\LOCALS~1\Temp |
SUCCESS | 0x02b10418 | |
| 09:15:37,830 | 2036 | NtCreateFile |
ShareAccess => 0 FileName => C:\Documents and Settings\TDW\Local Settings\Temp\acrord32_sbx\A9R4469.tmp DesiredAccess => 0x0012019f CreateDisposition => 5 FileHandle => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,830 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000490 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:37,830 | 2036 | NtQueryInformationFile |
FileHandle => 0x0000048c FileInformation => PA\xb4]\x8a\xa2\xcf\x01PA\xb4]\x8a\xa2\xcf\x01PA\xb4]\x8a\xa2\xcf\x01PA\xb4]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00ZL\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x90\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:37,850 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:37,850 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,850 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:37,850 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,860 | 2036 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
FAILURE | 0x00002af9 | |
| 09:15:37,940 | 2036 | getaddrinfo |
ServiceName => NodeName => acroipm2.adobe.com |
SUCCESS | 0x00000000 | |
| 09:15:37,940 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:15:37,950 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:37,950 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:37,950 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:37,950 | 2036 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:15:37,950 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:15:37,950 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:37,950 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:15:38,982 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b10488 | |
| 09:15:38,982 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b10488 | |
| 09:15:38,992 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b10488 | |
| 09:15:39,002 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32 |
SUCCESS | 0x02b10488 | |
| 09:15:39,002 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS\system32\shell32.dll |
SUCCESS | 0x02b10488 | |
| 09:15:39,022 | 2036 | FindFirstFileExW |
FileName => C:\WINDOWS |
SUCCESS | 0x02b10488 | 3 times |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,092 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,092 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xba\xb2]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,092 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,092 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,092 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xba\xb2]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,112 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,112 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,112 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,112 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,112 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,112 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,112 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 Rv^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,132 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,132 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xd9w^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,132 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,132 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,132 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xd9w^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,142 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,142 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0n|^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,142 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,142 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0n|^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,142 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,152 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,152 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,152 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0n|^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,152 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,152 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,152 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,152 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,152 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,152 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,152 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xf6}^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xf6}^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xf6}^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,172 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,172 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x04\x81^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,182 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,182 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x04\x81^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,182 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,182 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x04\x81^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,182 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,192 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,192 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,192 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,192 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\x8b\x82^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,202 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,202 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\x12\x84^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,202 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,202 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\x12\x84^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,202 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,212 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,212 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x9a\x85^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,212 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,212 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010!\x87^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,212 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,222 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,222 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010!\x87^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,222 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,232 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,232 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xa8\x88^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,232 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,232 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,232 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,232 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,232 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,232 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,232 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xa8\x88^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,242 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,242 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90/\x8a^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,242 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,242 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,242 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90/\x8a^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,252 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,252 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xb6\x8b^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,252 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,252 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,252 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xb6\x8b^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,262 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,262 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0=\x8d^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,262 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,262 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,262 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0=\x8d^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,282 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,282 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01PL\x90^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,282 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,282 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01PL\x90^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,282 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,292 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,292 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xd3\x91^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,292 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,292 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0Z\x93^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,292 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,302 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,302 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0Z\x93^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,302 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,302 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,302 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xe1\x94^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,322 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,322 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xe1\x94^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,322 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,322 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,322 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xe1\x94^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,332 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,332 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\xf0\x97^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,332 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,332 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,332 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01pw\x99^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,332 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,342 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,342 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01pw\x99^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,342 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,342 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,342 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xfe\x9a^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,362 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,362 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xfe\x9a^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,362 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,362 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,362 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xfe\x9a^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,362 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,373 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,373 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00 \x9e^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,373 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,373 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,383 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x94\x9f^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,383 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,383 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x94\x9f^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,383 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,383 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,383 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x1b\xa1^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,403 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,403 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x1b\xa1^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,403 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,403 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x1b\xa1^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,403 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,413 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,413 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0)\xa4^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,413 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,413 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xb0\xa5^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,413 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,423 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,423 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xb0\xa5^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,423 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,423 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 8\xa7^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,423 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,433 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,433 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 8\xa7^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,433 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,433 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 8\xa7^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,433 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,443 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,443 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,443 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xbf\xa8^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,453 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,453 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80F\xaa^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,453 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,453 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xcd\xab^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,453 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,463 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,463 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xcd\xab^\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01\xf0\xf36]\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,463 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,483 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,483 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,483 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xe0T\xad^\x8a\xa2\xcf\x01\xe0T\xad^\x8a\xa2\xcf\x01\xe0T\xad^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,493 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,493 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,503 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,503 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\xea\xb1^\x8a\xa2\xcf\x01p\xea\xb1^\x8a\xa2\xcf\x01p\xea\xb1^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,503 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,503 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0q\xb3^\x8a\xa2\xcf\x01p\xea\xb1^\x8a\xa2\xcf\x01p\xea\xb1^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,513 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,513 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,523 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,523 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,533 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,533 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x80\xb6^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,533 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,533 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,543 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x07\xb8^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,543 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,543 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x07\xb8^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,543 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,553 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,553 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x8e\xb9^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\x15\xbb^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\x15\xbb^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,563 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,563 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\x9c\xbc^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,573 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,573 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\x9c\xbc^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,573 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,573 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,583 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0#\xbe^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,583 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,583 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0#\xbe^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,583 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,593 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,593 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xab\xbf^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,593 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,593 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,593 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xab\xbf^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,823 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,823 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P2\xc1^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,823 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,833 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,833 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P2\xc1^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,833 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,833 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xde\xe5^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xde\xe5^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00f\xe7^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00f\xe7^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,843 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,843 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00f\xe7^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,863 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,863 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\xed\xe8^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,863 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`t\xea^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xfb\xeb^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01\xd0\xf8\xb4^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:39,873 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:39,873 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\xfb\xeb^\x8a\xa2\xcf\x01\x90\xfb\xeb^\x8a\xa2\xcf\x01\x90\xfb\xeb^\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,254 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,254 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,254 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,254 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,254 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,264 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,264 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,264 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`Z\x1b_\x8a\xa2\xcf\x01`Z\x1b_\x8a\xa2\xcf\x01`Z\x1b_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,264 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,274 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,274 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x93'_\x8a\xa2\xcf\x01`Z\x1b_\x8a\xa2\xcf\x01`Z\x1b_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,274 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,274 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,274 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,284 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,284 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\xa2*_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p),_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p),_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,294 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,294 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p),_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p),_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xb0-_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,304 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xb0-_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,304 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,314 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,314 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,314 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xb0-_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,324 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,324 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd07/_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,324 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,324 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,324 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd07/_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,324 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,334 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,334 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xbf0_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,334 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,334 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,334 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010F2_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,344 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,344 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010F2_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,344 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,344 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,344 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xcd3_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,364 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,364 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90T5_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,364 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,364 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90T5_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,364 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,374 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,374 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xdb6_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,374 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,374 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0b8_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,384 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,384 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0b8_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,384 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,384 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,384 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xea9_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,394 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,394 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xea9_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,394 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,394 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,394 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01Pq;_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,414 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,414 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01Pq;_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,414 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,414 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,414 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01Pq;_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,414 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,424 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,424 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\x7f>_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,424 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,424 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x06@_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,424 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,424 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,434 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x06@_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,434 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,434 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,434 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x8eA_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,444 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,444 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x8eA_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,444 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,444 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x8eA_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,454 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,454 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,454 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\x15C_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,464 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,464 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x9cD_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,464 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,464 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,464 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x9cD_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,474 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,474 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0#F_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,474 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,474 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,474 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xaaG_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,484 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,484 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xaaG_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,484 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,484 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,484 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x002I_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,504 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,504 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x002I_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,504 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,504 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,504 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x002I_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,504 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,514 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,514 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`@L_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,514 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,524 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,524 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xc7M_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,524 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,524 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xc7M_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,524 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,534 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,534 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0NO_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,534 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,534 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xd5P_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,534 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,544 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,544 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,544 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,544 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xd5P_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,554 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,554 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 ]R_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,554 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,554 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,554 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 ]R_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,554 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xe4S_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xe4S_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80kU_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,564 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,564 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80kU_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,574 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,574 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xf2V_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,574 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,574 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xf2V_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,574 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,584 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,584 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,584 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,584 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,584 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xf2V_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,594 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,594 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0yX_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,594 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,594 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,594 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0yX_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,604 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,604 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x01Z_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,604 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,604 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,604 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x01Z_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,614 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,614 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\x88[_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,614 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,614 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,614 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\x88[_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,614 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,624 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,624 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x0f]_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,624 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,624 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,624 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x0f]_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,644 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,644 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\x96^_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,644 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,644 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xa5a_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,644 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,654 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,654 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xa5a_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01\x10\x1b)_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,654 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,654 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,654 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010,c_\x8a\xa2\xcf\x010,c_\x8a\xa2\xcf\x010,c_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,664 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,664 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,664 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,664 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,674 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,674 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01`\xb3d_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,674 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,674 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,674 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,674 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,674 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,674 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,674 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90:f_\x8a\xa2\xcf\x01\x90:f_\x8a\xa2\xcf\x01\x90:f_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,714 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,714 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,714 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xdem_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,724 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xdem_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,724 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xdem_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xdem_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,734 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,734 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0eo_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,734 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,744 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0eo_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,744 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,744 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,744 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xecp_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xecp_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xecp_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:40,754 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:40,754 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10tr_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,035 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,035 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,035 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,035 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,035 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,035 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,035 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10tr_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,035 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,045 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,045 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,045 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,045 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,045 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,045 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P=\x9d_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,055 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,055 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,055 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,055 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,055 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,055 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,055 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0K\xa0_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01PWl_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,065 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,065 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,065 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,065 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xe0\xd2\xa1_\x8a\xa2\xcf\x01\xe0\xd2\xa1_\x8a\xa2\xcf\x01\xe0\xd2\xa1_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,085 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,085 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,085 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,085 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,095 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,095 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,105 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,105 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\xe1\xa4_\x8a\xa2\xcf\x01@\xe1\xa4_\x8a\xa2\xcf\x01@\xe1\xa4_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,105 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,105 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,105 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,105 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xef\xa7_\x8a\xa2\xcf\x01@\xe1\xa4_\x8a\xa2\xcf\x01@\xe1\xa4_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,115 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,115 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,115 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,115 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,115 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,115 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,115 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0v\xa9_\x8a\xa2\xcf\x01\xd0v\xa9_\x8a\xa2\xcf\x01\xd0v\xa9_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,125 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,135 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,135 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,135 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,135 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,456 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,456 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,456 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,456 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,466 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,466 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010k\xdd_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,466 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,466 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,466 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xf2\xde_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01\x00\xfe\xaa_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,466 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,476 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,476 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,476 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,476 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,476 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,476 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90y\xe0_\x8a\xa2\xcf\x01\x90y\xe0_\x8a\xa2\xcf\x01\x90y\xe0_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,516 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\x96\xe6_\x8a\xa2\xcf\x01P\x96\xe6_\x8a\xa2\xcf\x01P\x96\xe6_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,526 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,526 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\x1d\xe8_\x8a\xa2\xcf\x01P\x96\xe6_\x8a\xa2\xcf\x01P\x96\xe6_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,526 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,536 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,536 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,536 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,536 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,536 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,536 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0\xa4\xe9_\x8a\xa2\xcf\x01\xb0\xa4\xe9_\x8a\xa2\xcf\x01\xb0\xa4\xe9_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,606 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,606 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,606 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,616 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,616 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,936 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,936 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,936 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,946 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,946 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,946 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,946 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,956 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,956 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,956 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`K(`\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,966 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,966 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,966 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,966 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xd2)`\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01\x00W\xf4_\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:41,966 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:41,966 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:41,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:41,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:41,976 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:41,976 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:41,976 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xf0\xe0,`\x8a\xa2\xcf\x01\xf0\xe0,`\x8a\xa2\xcf\x01\xf0\xe0,`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,146 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,146 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,157 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,157 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,157 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,157 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,157 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,157 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,157 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0SE`\x8a\xa2\xcf\x01\xf0SE`\x8a\xa2\xcf\x01\xf0SE`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,157 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,167 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,167 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,167 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01PbH`\x8a\xa2\xcf\x01\xf0SE`\x8a\xa2\xcf\x01\xf0SE`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,177 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,177 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,177 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0pK`\x8a\xa2\xcf\x01\xb0pK`\x8a\xa2\xcf\x01\xb0pK`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,197 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,197 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,527 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,527 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,527 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,527 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,527 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,527 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,527 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,537 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,537 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,537 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,537 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,537 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01ps\x82`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00 \x87`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01\xe0\xf7L`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,567 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,567 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x00 \x87`\x8a\xa2\xcf\x01\x00 \x87`\x8a\xa2\xcf\x01\x00 \x87`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,617 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xac\x8e`\x8a\xa2\xcf\x01\xf0\xac\x8e`\x8a\xa2\xcf\x01\xf0\xac\x8e`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,627 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,627 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 4\x90`\x8a\xa2\xcf\x01\xf0\xac\x8e`\x8a\xa2\xcf\x01\xf0\xac\x8e`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,627 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,637 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,637 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,637 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,637 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,637 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:42,637 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01P\xbb\x91`\x8a\xa2\xcf\x01P\xbb\x91`\x8a\xa2\xcf\x01P\xbb\x91`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:42,687 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:42,697 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:42,697 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,018 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,018 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,018 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,028 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,028 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,028 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,028 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,038 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,038 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,038 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0S\xcd`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,048 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,048 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\xda\xce`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01@_\x99`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,048 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,058 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,058 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x00b\xd0`\x8a\xa2\xcf\x01\x00b\xd0`\x8a\xa2\xcf\x01\x00b\xd0`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x0f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,318 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,328 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,328 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,328 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,328 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,328 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,328 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,328 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,338 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,338 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,338 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,338 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x1c\xf8`\x8a\xa2\xcf\x01\xe0\x1c\xf8`\x8a\xa2\xcf\x01\xe0\x1c\xf8`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,338 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,348 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,348 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\xb2\xfc`\x8a\xa2\xcf\x01\xe0\x1c\xf8`\x8a\xa2\xcf\x01\xe0\x1c\xf8`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,348 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,358 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,358 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,358 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,358 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\xc0\xff`\x8a\xa2\xcf\x01\xd0\xc0\xff`\x8a\xa2\xcf\x01\xd0\xc0\xff`\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,408 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,418 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,418 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,769 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,769 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,769 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,769 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,769 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,769 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,769 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,769 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80g>a\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xfdBa\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01\xc0d\x07a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,799 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,799 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x10\xfdBa\x8a\xa2\xcf\x01\x10\xfdBa\x8a\xa2\xcf\x01\x10\xfdBa\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x11\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,929 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,929 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xccSa\x8a\xa2\xcf\x01 \xccSa\x8a\xa2\xcf\x01 \xccSa\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0aXa\x8a\xa2\xcf\x01 \xccSa\x8a\xa2\xcf\x01 \xccSa\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,939 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:43,939 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0aXa\x8a\xa2\xcf\x01\xb0aXa\x8a\xa2\xcf\x01\xb0aXa\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x12\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:43,989 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,989 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,989 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,989 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,989 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:43,999 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:43,999 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:43,999 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:43,999 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:43,999 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,320 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,320 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,320 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,320 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,320 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,320 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,320 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,330 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,330 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,330 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,330 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,330 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,330 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,330 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xfa\x93a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,340 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,340 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,340 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,340 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,340 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,340 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,340 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x81\x95a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01\xa0\x05`a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,350 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,350 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,350 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,350 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,350 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,350 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,350 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01`\x08\x97a\x8a\xa2\xcf\x01`\x08\x97a\x8a\xa2\xcf\x01`\x08\x97a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x13\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,360 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,360 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,360 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,360 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,370 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,370 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,370 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,370 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\x8f\x98a\x8a\xa2\xcf\x01\x90\x8f\x98a\x8a\xa2\xcf\x01\x90\x8f\x98a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,380 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,380 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,380 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,380 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,380 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,380 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,380 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\x9d\x9ba\x8a\xa2\xcf\x01\x90\x8f\x98a\x8a\xa2\xcf\x01\x90\x8f\x98a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,380 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,390 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,390 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,390 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,390 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,390 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,390 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01 %\x9da\x8a\xa2\xcf\x01 %\x9da\x8a\xa2\xcf\x01 %\x9da\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x14\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,450 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,450 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,910 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,910 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,910 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,910 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,910 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,910 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,910 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,910 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,941 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,941 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,941 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,941 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,941 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,941 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x9a\xeca\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,971 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,971 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p0\xf1a\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01\x10\xc9\xa4a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,971 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,971 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,971 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x00\xc6\xf5a\x8a\xa2\xcf\x01\x00\xc6\xf5a\x8a\xa2\xcf\x01\x00\xc6\xf5a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x15\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,981 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,981 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,981 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,981 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010M\xf7a\x8a\xa2\xcf\x010M\xf7a\x8a\xa2\xcf\x010M\xf7a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\xd4\xf8a\x8a\xa2\xcf\x010M\xf7a\x8a\xa2\xcf\x010M\xf7a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:44,991 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:44,991 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01`\xd4\xf8a\x8a\xa2\xcf\x01`\xd4\xf8a\x8a\xa2\xcf\x01`\xd4\xf8a\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x16\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,031 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,031 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,341 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,341 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,341 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,341 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,341 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,341 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,341 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,351 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,351 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,351 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,351 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,351 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,351 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,361 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xd7/b\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,361 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,361 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,361 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,361 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,361 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,361 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,361 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P^1b\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \xf1\xfea\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,371 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,371 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,371 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,371 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,371 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,371 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,371 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\xe52b\x8a\xa2\xcf\x01\x80\xe52b\x8a\xa2\xcf\x01\x80\xe52b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x17\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,381 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,381 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,381 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,381 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,391 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,391 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,391 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,391 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0l4b\x8a\xa2\xcf\x01\xb0l4b\x8a\xa2\xcf\x01\xb0l4b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,401 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,401 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,401 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,401 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,401 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,401 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,401 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10{7b\x8a\xa2\xcf\x01\xb0l4b\x8a\xa2\xcf\x01\xb0l4b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,411 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,411 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,411 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,411 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,411 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,411 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,411 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01@\x029b\x8a\xa2\xcf\x01@\x029b\x8a\xa2\xcf\x01@\x029b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,481 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,481 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,802 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,802 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,802 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,802 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,802 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,802 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,802 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,812 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,812 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,812 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,812 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,812 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,812 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,822 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0!vb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,822 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,822 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,822 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,822 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,822 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,832 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,832 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xa8wb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01`-Bb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,852 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,852 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,852 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,852 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,852 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,852 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:45,852 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80>|b\x8a\xa2\xcf\x01\x80>|b\x8a\xa2\xcf\x01\x80>|b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x19\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:45,962 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,962 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,962 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,962 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,962 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:45,982 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:45,982 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:45,982 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:45,982 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:45,982 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,022 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,022 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,022 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,022 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,022 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,022 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,022 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00x\x88b\x8a\xa2\xcf\x01\x00x\x88b\x8a\xa2\xcf\x01\x00x\x88b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,022 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,032 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,032 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,032 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,032 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,032 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,032 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb08\x96b\x8a\xa2\xcf\x01\x00x\x88b\x8a\xa2\xcf\x01\x00x\x88b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,042 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,042 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,042 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,042 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,062 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,062 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,062 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x10G\x99b\x8a\xa2\xcf\x01\x10G\x99b\x8a\xa2\xcf\x01\x10G\x99b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,172 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,172 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,493 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,493 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,493 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,493 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,503 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,503 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,503 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,513 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\x91\xdfb\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,513 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,513 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,523 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,523 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\x18\xe1b\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01\x80$\xadb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,523 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,523 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,523 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,523 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x10\xa0\xe2b\x8a\xa2\xcf\x01\x10\xa0\xe2b\x8a\xa2\xcf\x01\x10\xa0\xe2b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,533 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,543 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,543 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,553 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,553 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@'\xe4b\x8a\xa2\xcf\x01@'\xe4b\x8a\xa2\xcf\x01@'\xe4b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,553 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,553 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,553 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,553 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,553 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,553 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,563 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa05\xe7b\x8a\xa2\xcf\x01@'\xe4b\x8a\xa2\xcf\x01@'\xe4b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,563 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,563 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,563 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,563 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\xbc\xe8b\x8a\xa2\xcf\x01\xd0\xbc\xe8b\x8a\xa2\xcf\x01\xd0\xbc\xe8b\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,593 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,593 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,913 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,913 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,913 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,913 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,913 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,913 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,923 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,923 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,923 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,923 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,923 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,933 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,933 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,933 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xbf\x1fc\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,943 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,943 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,943 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,943 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,943 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,943 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,943 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xcd"c\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x010\xcb\xebb\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,953 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,953 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,953 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,953 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,953 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,953 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,953 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01 U$c\x8a\xa2\xcf\x01 U$c\x8a\xa2\xcf\x01 U$c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1d\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,973 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,983 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,983 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,983 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,983 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,983 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,983 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,993 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,993 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,993 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80c'c\x8a\xa2\xcf\x01\x80c'c\x8a\xa2\xcf\x01\x80c'c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:46,993 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:46,993 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:46,993 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:46,993 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:46,993 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:46,993 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:46,993 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0q*c\x8a\xa2\xcf\x01\x80c'c\x8a\xa2\xcf\x01\x80c'c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,003 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,003 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,003 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,003 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,003 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,003 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,003 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x10\xf9+c\x8a\xa2\xcf\x01\x10\xf9+c\x8a\xa2\xcf\x01\x10\xf9+c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1e\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,054 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,054 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,374 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,374 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,374 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,374 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x83dc\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,374 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,384 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,384 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x83dc\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01\x00\x9d3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,384 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,384 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,384 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010 fc\x8a\xa2\xcf\x010 fc\x8a\xa2\xcf\x010 fc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,394 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x91gc\x8a\xa2\xcf\x01`\x91gc\x8a\xa2\xcf\x01`\x91gc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\x18ic\x8a\xa2\xcf\x01`\x91gc\x8a\xa2\xcf\x01`\x91gc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,404 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,404 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\x18ic\x8a\xa2\xcf\x01\x90\x18ic\x8a\xa2\xcf\x01\x90\x18ic\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,444 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,444 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,755 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,755 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,755 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,755 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,755 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,755 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,755 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,765 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,765 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,765 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,765 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,765 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,765 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,775 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\x1b\xa0c\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,775 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,775 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,775 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,775 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,775 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,785 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,785 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80\xa2\xa1c\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01P5oc\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,785 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,785 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,785 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,785 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,785 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,785 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,785 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0)\xa3c\x8a\xa2\xcf\x01\xb0)\xa3c\x8a\xa2\xcf\x01\xb0)\xa3c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00!\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,805 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,805 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,815 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,815 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,815 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xb0\xa4c\x8a\xa2\xcf\x01\xe0\xb0\xa4c\x8a\xa2\xcf\x01\xe0\xb0\xa4c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,825 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,825 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,825 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\xbf\xa7c\x8a\xa2\xcf\x01\xe0\xb0\xa4c\x8a\xa2\xcf\x01\xe0\xb0\xa4c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,835 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,835 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,835 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,835 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,835 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:47,835 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xa0\xcd\xaac\x8a\xa2\xcf\x01\xa0\xcd\xaac\x8a\xa2\xcf\x01\xa0\xcd\xaac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00"\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:47,905 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:47,915 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:47,915 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:47,915 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:47,915 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,235 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,235 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,235 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,245 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,245 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,245 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01Pt\xe9c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,255 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,255 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01Pt\xe9c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01\xf0\x7f\xb5c\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,255 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,255 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,255 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\xfb\xeac\x8a\xa2\xcf\x01\x80\xfb\xeac\x8a\xa2\xcf\x01\x80\xfb\xeac\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00#\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,546 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,546 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,546 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,556 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,556 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,556 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0K\x17d\x8a\xa2\xcf\x01\xf0K\x17d\x8a\xa2\xcf\x01\xf0K\x17d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,556 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,566 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,566 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,566 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xd3\x18d\x8a\xa2\xcf\x01\xf0K\x17d\x8a\xa2\xcf\x01\xf0K\x17d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,566 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,566 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,566 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,566 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,566 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,566 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,566 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01PZ\x1ad\x8a\xa2\xcf\x01PZ\x1ad\x8a\xa2\xcf\x01PZ\x1ad\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00$\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,586 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,586 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,906 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,906 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,906 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,906 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,906 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,906 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,906 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,916 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,916 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,926 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,926 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,926 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,926 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,926 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xd5Od\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,926 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,936 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,936 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,936 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,936 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10]Qd\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01\xb0h\x1dd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,956 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,956 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,956 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,956 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xa0\xf2Ud\x8a\xa2\xcf\x01\xa0\xf2Ud\x8a\xa2\xcf\x01\xa0\xf2Ud\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00%\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,966 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,976 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,976 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,986 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,986 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0yWd\x8a\xa2\xcf\x01\xd0yWd\x8a\xa2\xcf\x01\xd0yWd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,986 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,996 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:48,996 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:48,996 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:48,996 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x88Zd\x8a\xa2\xcf\x01\xd0yWd\x8a\xa2\xcf\x01\xd0yWd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:48,996 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:48,996 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:48,996 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:48,996 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,006 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,006 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,006 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\x96]d\x8a\xa2\xcf\x01\x90\x96]d\x8a\xa2\xcf\x01\x90\x96]d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00&\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,066 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,066 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,066 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,066 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,387 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,387 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,387 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,387 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,387 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,387 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,387 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,397 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,397 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,397 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,397 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,397 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,397 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,407 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xa7\x97d\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,407 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,407 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,407 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,407 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,407 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,407 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,407 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\xb6\x9ad\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01\x80:ed\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,417 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,417 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,417 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,417 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,417 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,417 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,417 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01@=\x9cd\x8a\xa2\xcf\x01@=\x9cd\x8a\xa2\xcf\x01@=\x9cd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00'\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,437 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,437 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,437 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,437 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,437 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,447 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,447 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,457 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,457 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,457 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0K\x9fd\x8a\xa2\xcf\x01\xa0K\x9fd\x8a\xa2\xcf\x01\xa0K\x9fd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,457 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,457 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,457 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,457 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,457 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,457 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,467 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00Z\xa2d\x8a\xa2\xcf\x01\xa0K\x9fd\x8a\xa2\xcf\x01\xa0K\x9fd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,467 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,467 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,467 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,467 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,467 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,467 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,467 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010\xe1\xa3d\x8a\xa2\xcf\x010\xe1\xa3d\x8a\xa2\xcf\x010\xe1\xa3d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,647 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,657 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,657 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,978 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,978 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,978 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,978 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,978 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,978 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,978 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,978 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,988 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,988 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,988 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,988 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,988 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,998 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xcf\xf1d\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:49,998 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:49,998 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:49,998 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:49,998 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:49,998 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:49,998 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:49,998 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \xde\xf4d\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01\x90b\xbfd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,008 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,018 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,018 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,018 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,018 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\xec\xf7d\x8a\xa2\xcf\x01\x80\xec\xf7d\x8a\xa2\xcf\x01\x80\xec\xf7d\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00)\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,038 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,048 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,048 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,048 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,048 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,058 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xfa\xfad\x8a\xa2\xcf\x01\xe0\xfa\xfad\x8a\xa2\xcf\x01\xe0\xfa\xfad\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,058 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,058 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,058 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,058 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,058 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,058 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,058 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@ \xfed\x8a\xa2\xcf\x01\xe0\xfa\xfad\x8a\xa2\xcf\x01\xe0\xfa\xfad\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,058 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,068 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,068 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,068 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,068 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,068 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,078 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01p\x90\xffd\x8a\xa2\xcf\x01p\x90\xffd\x8a\xa2\xcf\x01p\x90\xffd\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00*\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,118 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,118 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,428 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,428 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,428 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,428 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,428 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,428 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,428 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,428 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,438 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,438 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,438 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,438 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,438 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,448 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\x936e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,448 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,448 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xa19e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01`4\x07e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,448 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,448 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,448 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\xa19e\x8a\xa2\xcf\x01\x90\xa19e\x8a\xa2\xcf\x01\x90\xa19e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00+\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,478 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,478 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,488 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,488 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,488 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,488 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,488 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,488 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,488 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\xaf<e\x8a\xa2\xcf\x01\xf0\xaf<e\x8a\xa2\xcf\x01\xf0\xaf<e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,499 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,499 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,499 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,499 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,499 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,499 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,499 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80EAe\x8a\xa2\xcf\x01\xf0\xaf<e\x8a\xa2\xcf\x01\xf0\xaf<e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,509 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,509 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,509 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,509 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,509 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,509 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:50,509 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0\xccBe\x8a\xa2\xcf\x01\xb0\xccBe\x8a\xa2\xcf\x01\xb0\xccBe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00,\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:50,849 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,849 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,849 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,849 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,849 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:50,859 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:50,859 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:50,859 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:50,859 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:50,859 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,179 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,179 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,179 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,179 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,179 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,179 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,179 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,190 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,190 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,190 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,190 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,190 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,190 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,190 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\xb5\xaae\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,200 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,200 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,200 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,200 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,200 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,200 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,200 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\xb5\xaae\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01\x80+re\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,200 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,210 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,210 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,210 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,210 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,210 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,210 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\xc3\xade\x8a\xa2\xcf\x01\xd0\xc3\xade\x8a\xa2\xcf\x01\xd0\xc3\xade\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00-\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,220 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,220 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,220 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,220 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,230 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,230 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,230 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,230 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,230 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,230 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,230 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,240 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,240 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,240 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,240 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,240 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,240 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00K\xafe\x8a\xa2\xcf\x01\x00K\xafe\x8a\xa2\xcf\x01\x00K\xafe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,240 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,250 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,250 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,250 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,250 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,250 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,250 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`Y\xb2e\x8a\xa2\xcf\x01\x00K\xafe\x8a\xa2\xcf\x01\x00K\xafe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,250 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,250 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,260 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,260 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,260 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,260 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,260 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xc0g\xb5e\x8a\xa2\xcf\x01\xc0g\xb5e\x8a\xa2\xcf\x01\xc0g\xb5e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00.\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,290 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,300 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,300 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,300 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,300 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,610 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,610 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,610 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,610 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,610 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,610 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,610 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,620 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,620 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,620 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,620 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,620 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,620 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,630 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80j\xece\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,630 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,630 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,630 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,630 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,630 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,630 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,630 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\xf1\xede\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01P\xfd\xb9e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,640 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,640 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,640 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,640 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,640 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,640 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,640 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xe0x\xefe\x8a\xa2\xcf\x01\xe0x\xefe\x8a\xa2\xcf\x01\xe0x\xefe\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x00/\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,650 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,650 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,660 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,660 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,670 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,670 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,670 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x00\xf1e\x8a\xa2\xcf\x01\x10\x00\xf1e\x8a\xa2\xcf\x01\x10\x00\xf1e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,670 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,680 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,680 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,680 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,680 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,680 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\x0e\xf4e\x8a\xa2\xcf\x01\x10\x00\xf1e\x8a\xa2\xcf\x01\x10\x00\xf1e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,680 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,680 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,680 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,690 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,690 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,690 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:51,690 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\x1c\xf7e\x8a\xa2\xcf\x01\xd0\x1c\xf7e\x8a\xa2\xcf\x01\xd0\x1c\xf7e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x000\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:51,710 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:51,710 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,041 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,041 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,041 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`\x98,f\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\x1f.f\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01\x00\xa4\xf8e\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,051 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,051 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x90\x1f.f\x8a\xa2\xcf\x01\x90\x1f.f\x8a\xa2\xcf\x01\x90\x1f.f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x001\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,061 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,061 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xa6/f\x8a\xa2\xcf\x01\xc0\xa6/f\x8a\xa2\xcf\x01\xc0\xa6/f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0-1f\x8a\xa2\xcf\x01\xc0\xa6/f\x8a\xa2\xcf\x01\xc0\xa6/f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,071 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,071 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xf0-1f\x8a\xa2\xcf\x01\xf0-1f\x8a\xa2\xcf\x01\xf0-1f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x002\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,121 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,121 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,441 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,441 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,441 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,441 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,441 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,441 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,441 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,451 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,451 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,451 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,451 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,451 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,451 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,461 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10?kf\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,461 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,461 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,461 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,461 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,461 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,471 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,471 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\xc6lf\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01\xe0\xd18f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,471 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,471 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,471 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,471 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01pMnf\x8a\xa2\xcf\x01pMnf\x8a\xa2\xcf\x01pMnf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x003\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,481 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,481 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,481 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,481 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,491 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,491 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,491 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,491 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xd4of\x8a\xa2\xcf\x01\xa0\xd4of\x8a\xa2\xcf\x01\xa0\xd4of\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,501 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,501 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,501 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,501 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,501 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,501 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,501 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xe3rf\x8a\xa2\xcf\x01\xa0\xd4of\x8a\xa2\xcf\x01\xa0\xd4of\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,501 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,511 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,511 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,511 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,511 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,511 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,511 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010jtf\x8a\xa2\xcf\x010jtf\x8a\xa2\xcf\x010jtf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x004\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,551 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,561 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,561 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,872 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,872 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,872 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,872 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,872 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,872 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,872 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,882 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,882 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,882 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,882 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,882 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,892 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,892 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0l\xabf\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,892 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,892 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,892 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,892 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,892 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,902 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,902 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P{\xaef\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01\xf0\x86zf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,902 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,902 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,902 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,902 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,902 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,902 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,902 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\x02\xb0f\x8a\xa2\xcf\x01\x80\x02\xb0f\x8a\xa2\xcf\x01\x80\x02\xb0f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x005\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,922 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,922 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,932 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,932 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,932 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,932 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,932 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,932 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,932 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xb0\x89\xb1f\x8a\xa2\xcf\x01\xb0\x89\xb1f\x8a\xa2\xcf\x01\xb0\x89\xb1f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,932 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,942 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,942 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,942 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,942 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,942 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,942 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10\x98\xb4f\x8a\xa2\xcf\x01\xb0\x89\xb1f\x8a\xa2\xcf\x01\xb0\x89\xb1f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,942 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,942 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,952 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,952 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,952 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,952 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:52,952 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000494 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01p\xa6\xb7f\x8a\xa2\xcf\x01p\xa6\xb7f\x8a\xa2\xcf\x01p\xa6\xb7f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00[L\x00\x00\x00\x006\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:52,982 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:52,992 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:52,992 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x00000498 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegOpenKeyExW |
Handle => 0x00000494 Registry => 0x80000002 SubKey => System |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegCreateKeyExW |
Handle => 0x00000494 Access => 33554432 Registry => 0x80000002 Class => SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegDeleteKeyW |
Handle => 0x80000002 SubKey => System\Acrobatbrokerserverdispatchercpp789 |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegOpenKeyExW |
Handle => 0x00000494 Registry => 0x80000002 SubKey => Software\Microsoft\Windows\CurrentVersion |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegQueryValueExW |
Handle => 0x00000494 Data => C\x00:\x00\\x00P\x00r\x00o\x00g\x00r\x00a\x00m\x00 \x00F\x00i\x00l\x00e\x00s\x00\\x00C\x00o\x00m\x00m\x00o\x00n\x00 \x00F\x00i\x00l\x00e\x00s\x00\x00\x00 ValueName => CommonFilesDir |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | RegCloseKey |
Handle => 0x00000494 |
SUCCESS | 0x00000000 | |
| 09:15:53,152 | 2036 | LdrGetDllHandle |
ModuleHandle => 0x7c800000 FileName => KERNEL32.DLL |
SUCCESS | 0x00000000 | |
| 09:15:53,172 | 2036 | ShellExecuteExW |
Show => 1 Parameters => /PRODUCT:Reader /VERSION:11.0 /MODE:3 FilePath => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" |
SUCCESS | 0x00000001 | |
| 09:15:53,323 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,323 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,323 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,323 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,323 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,323 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,323 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,333 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,333 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`0\xf0f\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,333 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,333 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xb7\xf1f\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01\x00<\xbcf\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,333 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,363 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,363 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,363 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01 M\xf6f\x8a\xa2\xcf\x01 M\xf6f\x8a\xa2\xcf\x01 M\xf6f\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,583 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,593 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,603 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,603 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10d\x16g\x8a\xa2\xcf\x01\x10d\x16g\x8a\xa2\xcf\x01\x10d\x16g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xd0\x80\x1cg\x8a\xa2\xcf\x01\x10d\x16g\x8a\xa2\xcf\x01\x10d\x16g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,613 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,613 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\x80\x1cg\x8a\xa2\xcf\x01\xd0\x80\x1cg\x8a\xa2\xcf\x01\xd0\x80\x1cg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\L\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,673 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,673 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:53,994 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:53,994 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:53,994 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:53,994 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:53,994 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:53,994 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,004 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,014 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,014 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,014 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,014 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,014 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,014 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,024 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 \x19Xg\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,024 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,024 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,024 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,024 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,024 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,024 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,024 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x80'[g\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01\xc0$$g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,034 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,034 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,034 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,034 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,034 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,034 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,034 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xb0\xae\g\x8a\xa2\xcf\x01\xb0\xae\g\x8a\xa2\xcf\x01\xb0\xae\g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,064 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,074 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,074 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,074 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@Dag\x8a\xa2\xcf\x01@Dag\x8a\xa2\xcf\x01@Dag\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,074 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,084 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,084 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,084 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,084 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01p\xcbbg\x8a\xa2\xcf\x01@Dag\x8a\xa2\xcf\x01@Dag\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,084 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,084 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,084 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,084 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,094 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,094 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,094 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xd0\xd9eg\x8a\xa2\xcf\x01\xd0\xd9eg\x8a\xa2\xcf\x01\xd0\xd9eg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x02\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,104 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,104 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,104 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,104 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,114 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,114 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,114 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,114 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,114 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,114 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,424 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,424 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,424 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00G\x98g\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010\xce\x99g\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01\x00agg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,434 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,434 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010\xce\x99g\x8a\xa2\xcf\x010\xce\x99g\x8a\xa2\xcf\x010\xce\x99g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x03\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,444 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01`U\x9bg\x8a\xa2\xcf\x01`U\x9bg\x8a\xa2\xcf\x01`U\x9bg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,454 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90\xdc\x9cg\x8a\xa2\xcf\x01`U\x9bg\x8a\xa2\xcf\x01`U\x9bg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,454 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,464 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,464 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,464 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,474 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,474 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,474 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,795 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,795 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,795 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,795 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,795 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,795 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,795 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,805 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,805 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,805 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,815 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01 X\xd2g\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,815 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,815 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,815 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,815 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P\xdf\xd3g\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01\xc0c\x9eg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,825 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,825 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,825 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,825 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80f\xd5g\x8a\xa2\xcf\x01\x80f\xd5g\x8a\xa2\xcf\x01\x80f\xd5g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,845 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,855 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,855 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,865 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,865 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0t\xd8g\x8a\xa2\xcf\x01\xe0t\xd8g\x8a\xa2\xcf\x01\xe0t\xd8g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,865 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,865 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01@\x83\xdbg\x8a\xa2\xcf\x01\xe0t\xd8g\x8a\xa2\xcf\x01\xe0t\xd8g\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,865 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,875 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,875 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,875 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:54,875 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01p \xddg\x8a\xa2\xcf\x01p \xddg\x8a\xa2\xcf\x01p \xddg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x06\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:54,895 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:54,895 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,215 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,215 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,215 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,215 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,215 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,215 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,215 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,225 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,225 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,225 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,225 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,225 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,225 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,235 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\x86\x12h\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,235 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,235 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,235 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,235 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x010 \x14h\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01\xa0\x91\xdeg\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,245 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,245 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,245 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,245 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01`\x94\x15h\x8a\xa2\xcf\x01`\x94\x15h\x8a\xa2\xcf\x01`\x94\x15h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,275 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,285 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,285 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,285 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,285 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,285 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,285 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,285 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,285 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0)\x1ah\x8a\xa2\xcf\x01\xf0)\x1ah\x8a\xa2\xcf\x01\xf0)\x1ah\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,295 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,295 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01P8\x1dh\x8a\xa2\xcf\x01\xf0)\x1ah\x8a\xa2\xcf\x01\xf0)\x1ah\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,295 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,305 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,305 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,305 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,305 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\xbf\x1eh\x8a\xa2\xcf\x01\x80\xbf\x1eh\x8a\xa2\xcf\x01\x80\xbf\x1eh\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,325 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,325 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,646 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,646 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,646 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,656 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,656 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xe0\xb3Rh\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,656 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,656 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x10;Th\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01\xe0\xcd!h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,656 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,666 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,666 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,666 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01@\xc2Uh\x8a\xa2\xcf\x01@\xc2Uh\x8a\xa2\xcf\x01@\xc2Uh\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,686 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,686 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,686 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,686 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,696 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,696 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,706 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,706 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,706 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,706 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0\xd0Xh\x8a\xa2\xcf\x01\xa0\xd0Xh\x8a\xa2\xcf\x01\xa0\xd0Xh\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,706 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,706 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,706 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,716 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,716 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x00\xdf[h\x8a\xa2\xcf\x01\xa0\xd0Xh\x8a\xa2\xcf\x01\xa0\xd0Xh\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,716 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,716 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,716 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:55,716 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010f]h\x8a\xa2\xcf\x010f]h\x8a\xa2\xcf\x010f]h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:55,736 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:55,736 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,056 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,056 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,056 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,056 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,067 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,067 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,067 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,067 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,067 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,077 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,077 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xc0\xe1\x92h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,077 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,077 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,077 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,087 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,087 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,087 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,087 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xf0h\x94h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01\x90t`h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,087 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,097 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,097 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,097 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,107 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,107 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,107 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x01\x80\xfe\x98h\x8a\xa2\xcf\x01\x80\xfe\x98h\x8a\xa2\xcf\x01\x80\xfe\x98h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x0b\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,167 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,177 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,177 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,187 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,187 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,187 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\xa0)\xa2h\x8a\xa2\xcf\x01\xa0)\xa2h\x8a\xa2\xcf\x01\xa0)\xa2h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,187 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,187 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,187 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,197 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => `\x81\x98R\x8a\xa2\xcf\x01\x008\xa5h\x8a\xa2\xcf\x01\xa0)\xa2h\x8a\xa2\xcf\x01\xa0)\xa2h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00l\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00@L\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\x9c\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,197 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,197 | 2036 | NtCreateFile |
ShareAccess => 3 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x0012019f CreateDisposition => 3 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,197 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:56,207 | 2036 | NtQueryInformationFile |
FileHandle => 0x000004a8 FileInformation => \x90\xc0\x88\\x8a\xa2\xcf\x010\xbf\xa6h\x8a\xa2\xcf\x010\xbf\xa6h\x8a\xa2\xcf\x010\xbf\xa6h\x8a\xa2\xcf\x01 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00_L\x00\x00\x00\x00\x0c\x00\x00\x00\x00\x00\x9f\x01\x12\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x01\x00\x00\x00\xac\x00\x00\x00\\x00D\x00 |
FAILURE | 2147483653 | |
| 09:15:56,217 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,217 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | FindFirstFileExW |
FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0 |
SUCCESS | 0x02b10488 | |
| 09:15:56,227 | 2036 | NtCreateFile |
ShareAccess => 7 FileName => C:\Documents and Settings\TDW\Application Data\Adobe\Acrobat\11.0\ReaderMessages-journal DesiredAccess => 0x00010080 CreateDisposition => 1 FileHandle => 0x000004a8 |
SUCCESS | 0x00000000 | |
| 09:15:56,227 | 2036 | NtOpenDirectoryObject |
DirectoryHandle => 0x000004b0 DesiredAccess => 1 ObjectAttributes => C:\?? |
SUCCESS | 0x00000000 | |
| 09:15:58,280 | 1028 | select |
socket => 0x00000003 |
SUCCESS | 0x00000001 | |
| 09:15:58,280 | 2036 | closesocket |
socket => 0x0000047c |
SUCCESS | 0x00000000 | |
| 09:15:58,280 | 2036 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x02b10a90 | |
| 09:15:58,280 | 2036 | OpenServiceW |
ServiceControlManager => 0x02b10a90 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x02b10ab8 | |
| 09:15:58,290 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:58,290 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:58,360 | 2036 | LdrGetProcedureAddress |
Ordinal => 0 FunctionName => InternetCloseHandle FunctionAddress => 0x771c4d8c ModuleHandle => 0x771b0000 |
SUCCESS | 0x00000000 | |
| 09:15:58,981 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:15:58,981 | 2036 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:58,981 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:15:58,981 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:58,981 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:15:58,981 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:15:59,011 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:15:59,011 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x15\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:15:59,011 | 2036 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:15:59,011 | 1028 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:15:59,011 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:15:59,011 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:16:06,291 | 1656 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | 1 time |
| 09:16:20,011 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:16:20,011 | 2036 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableFileTracing |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => FileTracingMask |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 0 ValueName => EnableConsoleTracing |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 4294901760 ValueName => ConsoleTracingMask |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => 1048576 ValueName => MaxFileSize |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | RegQueryValueExA |
Handle => 0x00000448 Data => %windir%\tracing\x00 ValueName => FileDirectory |
SUCCESS | 0x00000000 | |
| 09:16:20,011 | 2036 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x001ee358 | |
| 09:16:20,021 | 2036 | OpenServiceW |
ServiceControlManager => 0x001ee358 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x001ee1c8 | |
| 09:16:20,021 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:16:20,021 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:20,021 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:16:20,031 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:20,031 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:16:20,031 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04\x1a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:20,031 | 2036 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:16:20,031 | 1028 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:16:20,031 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:16:20,031 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:16:35,603 | 1272 | CreateThread |
ThreadId => 976 StartRoutine => 0x77e76c7d Parameter => 0x001eea30 CreationFlags => 0 |
SUCCESS | 0x00000268 | |
| 09:16:41,041 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:16:41,041 | 2036 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:41,041 | 2036 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00246458 | |
| 09:16:41,041 | 2036 | OpenServiceW |
ServiceControlManager => 0x00246458 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x02b10a68 | |
| 09:16:41,041 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:16:41,051 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:41,051 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:16:41,051 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:16:41,051 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:16:41,051 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:16:41,061 | 2036 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:16:41,061 | 1028 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:16:41,061 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:16:41,061 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:17:01,971 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 | |
| 09:17:01,971 | 2036 | closesocket |
socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:17:01,971 | 2036 | OpenSCManagerW |
MachineName => DatabaseName => DesiredAccess => 2147483648 |
SUCCESS | 0x00246458 | |
| 09:17:01,971 | 2036 | OpenServiceW |
ServiceControlManager => 0x00246458 ServiceName => RASMAN DesiredAccess => 4 |
SUCCESS | 0x00246278 | |
| 09:17:01,971 | 2036 | RegQueryValueExA |
Handle => 0x0000033c DataLength => 4 ValueName => EnableAutodial Type => 828 |
FAILURE | 0x00000002 | |
| 09:17:01,981 | 2036 | NtQueryInformationFile |
FileHandle => 0x00000380 FileInformation => \x00\xc0\x03\x00\x00\x00\x00\x00\x00\xc0\x03\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:17:01,981 | 2036 | socket |
type => 1 protocol => 6 af => 2 |
SUCCESS | 0x0000048c | |
| 09:17:01,981 | 2036 | ioctlsocket |
command => 2147772030 socket => 0x0000048c |
SUCCESS | 0x00000000 | |
| 09:17:01,981 | 2036 | bind |
ip => 0.0.0.0 socket => 0x0000048c port => 0 |
SUCCESS | 0x00000000 | |
| 09:17:01,981 | 2036 | NtDeviceIoControlFile |
InputBuffer => FileHandle => 0x0000048c OutputBuffer => \x01\x00\x00\x00\x01\x00\x00\x00\x0e\x00\x02\x00\x04#\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 |
SUCCESS | 0x00000000 | |
| 09:17:01,991 | 2036 | connect |
socket => 0x0000048c |
FAILURE | 4294967295 | |
| 09:17:01,991 | 1028 | select |
socket => 0x00000001 |
SUCCESS | 0x00000001 | |
| 09:17:02,001 | 1028 | WSARecv |
socket => 0x000003c8 |
SUCCESS | 0x00000000 | |
| 09:17:02,001 | 2036 | send |
buffer => ! socket => 0x000003c8 |
SUCCESS | 0x00000001 | |
| 09:17:05,617 | 680 | ExitThread |
ExitCode => 0 |
SUCCESS | 0x00000000 | |
| 09:17:11,926 | 1028 | select |
socket => 0x00000002 |
SUCCESS | 0x00000001 |